Port scan alert

[OMammadov1]

Hi everyone,

There is some situation in our case.

For example there is 2 windows host. Host1 and Host2. Host1 have XDR. But Host2 not. If Host2 executes port scan action (it doesn't matter which tool is using -- nmap, zenmap and etc) to Host1 in this case i cannot receive any alert for this action without NGFW. Is there any option to detect this action and make this event as alert in Cortex XDR?

Thanks in advance! 

[Mudhireddy]

Yes, XDR Analytics detects the port scan events and creates an alert in the alert table.

Read more details https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-data-s...

[OMammadov1]

In this case, do i need to enable windows firewall? or do i need to do additional things for this rule to work? or Host Firewall policy in Cortex?.Because i found this rule -- "Enumeration of Windows services from public IP addresses" and  the ATT&CK Tactic and ATT&CK Technique are the same as those in the link you provided.

[OMammadov1]

On the other hand im talking about host's incoming and outgoing network. For example, if someone executes port scan action (via some tool like nmap or zenmap) to another users computer(which is have XDR agent) in this case i need to detect this action.

[Mudhireddy]

you don't required any thing from windows side settings, configure your XDR agent-setting profile with PRO features to collect the EED logs to get the alerts from analytics.

Thanks,

Suresh

[OMammadov1]

I have configured the profiles correctly in Cortex XDR include agent settings. But there is no alert.