Palo Alto - possible nmap scan on with top 100 option

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


Detect possible execution of Nmap top 100 option. This detection will detect scanning of 90% of Top 100 port of NMAP in less than 2 minutes. Unusual port only access through a scan are present in this list which is a good indicator of reconnaissance tactics. Whitelisting of Company scanners is required with implementation of the rule. Ref : https://nmap.org/book/performance-port-selection.html

Attribute Value
Type Analytic Rule
Solution PaloAlto-PAN-OS
ID 4d61bb9a-7f6d-45b1-ac0e-517e2a92f6fd
Severity Medium
Status Available
Kind Scheduled
Tactics Reconnaissance
Techniques T1595
Required Connectors CefAma
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
CommonSecurityLog ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to PaloAlto-PAN-OS