02-01-2018 06:55 AM
Hello all,
We just recently made the Shodan wall of fame and I'm now getting their scan showing up every day in my Threat log. Our action is set to reset. What do you typically do in this case? Should I ignore this and accept I will be seeing this scan every day from now on?
Threat Name | Gh0st.Gen Command and Control Traffic |
Attacker | 66.240.205.34 |
02-01-2018 08:30 AM
One suggestion would be to implement Zone Protection and/or DoS Protection to block reconnaissance activity of this nature if you have not already done so.
Otherwise, you could implement the use of EDLs in conjunction with an automated feed from somewhere such as Minemeld to dynamically block Shodan activity.
02-01-2018 08:30 AM
One suggestion would be to implement Zone Protection and/or DoS Protection to block reconnaissance activity of this nature if you have not already done so.
Otherwise, you could implement the use of EDLs in conjunction with an automated feed from somewhere such as Minemeld to dynamically block Shodan activity.
02-01-2018 08:46 AM
Thank you! The Zone Protection was what I was looking for.
Question on EDL: I have it setup to block Outgoing IP's, but this Shodan scan is Incoming. I'm assuming I can set an EDL to also block Incoming connections by setting the EDL in the Source Address as opposed to Destination?
02-01-2018 08:57 AM
External Dynamic Lists can be used in security policies regardless of directionality. Behavior will vary depending on the type of list. In your case you can specify and IP-based EDLs within the source column of a security policy rule.
02-01-2018 09:26 AM
You are very welcome. It was my pleasure.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
