nmap attack event
Example of scan of all ports with nmap, and TCP:
EventID=3011388922094660568 IncidentID=3011389064053784202 Tagkey=10.11.4.26:39512:10.11.4.27:11110:3000982640374151870-15ec7092-a2b8-11ed-b46b-52201c5a5c62 DecoyGroup=IT_Decoy DecoyType=Windows10 AttackerIP=10.11.4.26 AttackerPort=39512 VictimIP=10.11.4.27 VictimPort=11110 Operation=Disconnect_TCP_connection Service=TCPListener Username=NA Password=NA Description="Disconnection"
Example of port scanning:
Operation=Port_Scan AttackerIP=10.12.4.1 VictimIP=10.12.4.21 Description="Port.Scanning"
| Log Field Name | Description | Data Type |
|---|---|---|
|
Operation |
Operation name |
string |
|
AttackerIP |
Attacker ip address |
string |
|
VictimIP |
Victim ip address |
string |
|
Description |
Attack detail |
string |