reconnaissance protection alert search

[Jameslee20]

reconnaissance protection alert search

We have alerts set up but I need to search for the alerts but what is the search string 

[PavelK]

Hello @Jameslee20

thanks for post!

You can use this filter: ( subtype eq 'scan' ) in Threat logs.

It includes Host Sweep (ID 8002), TCP Port Scan(ID 8001) and UDP Port Scan (ID 8003).

Kind Regards

Pavel

[Jameslee20]

nothing pop is there another scan

[PavelK]

Hello @Jameslee20

thank you for reply.

The filter ( subtype eq 'scan' ) is a Threat type filter that will display all types of scanning events. Since nothing shows up in logs in your case, could you confirm below points:

- Did you enable "Log Setting" under zone where zone protection is enabled? Please refer to this KB: Difference between Log Forwarding for a Zone and Security Policy Log Forwarding (Scroll down to section "Zone Log Forwarding").

- Could you review this KB: Zone Protection Profile Not Generating Logs During Penetration Scan? There are no threat logs if there is "deny" action in security policy.

- Could you review this KB: How to investigate "SCAN: TCP Port Scan" alerts? The scanning event will be generated only when scan exceeds the Threshold (Events) within the Interval (Sec) defined in the Zone Protection profile applied to the ingress Zone for TCP Port Scan.

- Could you make sure that traffic you are investigating is not included in the exception list (source address exclusion)?

Kind Regards

Pavel