From 3393446afbad0dcce43c7c2ca61583cb50bb2ed8 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 2 Jun 2025 12:31:03 -0700
Subject: [PATCH] Update internal_horizontal_port_scan_nmap_top_20.yml

Chatted with detection author about this update.
Changed risk_object from dest_zone to dest_ports to be more in line with other horizontal scanning detection AND give more meaningful risk object (dest_zone is less meaningful, even if populated)
---
 .../network/internal_horizontal_port_scan_nmap_top_20.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
index b2767bfdee..44b2e9546f 100644
--- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
+++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
@@ -52,7 +52,7 @@ rba:
   message: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination
     IPs
   risk_objects:
-  - field: dest_zone
+  - field: dest_ports
     type: system
     score: 72
   threat_objects: