admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update internal_horizontal_port_scan_nmap_top_20.yml

Browse Source 
Chatted with detection author about this update.
Changed risk_object from dest_zone to dest_ports to be more in line with other horizontal scanning detection AND give more meaningful risk object (dest_zone is less meaningful, even if populated)
This commit is contained in:
pyth0n1c
2025-06-02 12:31:03 -07:00
committed by GitHub
parent e7f59f1ffc
commit 3393446afb
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/network/internal_horizontal_port_scan_nmap_top_20.yml
+1 -1
View File
@@ -52,7 +52,7 @@ rba:
message: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination
IPs
risk_objects:
- field: dest_zone
- field: dest_ports
type: system
score: 72
threat_objects: