EBA: Potential Port Scanning Behavior Detected on events which are detected by the Local system
The QRadar® User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Potential Port Scanning Behavior Detected on events which are detected by the Local system
Enabled by default
True
Default senseValueDestination
5
Default senseValueSource
10
Description
Detects potential port scanning activity by identifying a source IP attempting connections to 50 or more different destination ports within a 10-minute period.
Support rules
- BB:UBA : Common Log Source Filters
Log source types
Firewall logs, Network Flow (NetFlow), EDR Telemetry