port_scan event NXQL (classic)
A port scan is a sequence of failed TCP connections or UDP packets made to the same destination to more than 50 ports within a few seconds.
Name | Type | Operating systems | Properties |
---|---|---|---|
cardinality | integer | Windows | macOS | |
Number of underlying connections, consolidated over time | |||
destination_ip_address | ip_address | Windows | macOS | |
IP address of the scanned destination | |||
device_ip_address | ip_address | Windows | macOS | |
IP address of the connection source | |||
duration | millisecond | Windows | macOS | |
The time between the start of the first connection and end of the last underlying connection. | |||
end_time | datetime | Windows | macOS | |
Scanning end time, corresponding to the moment when the last underlying connection was closed. | |||
first_scanned_port | port | Windows | macOS | |
First port scanning | |||
id | identifier | Windows | macOS | |
Unique scanning identifier | |||
last_scanned_port | port | Windows | macOS | |
Last port scanning | |||
start_time | datetime | Windows | macOS | |
Scanning start time | |||
status | enum | Windows | macOS | |
Status of the Scanning (established, closed) | |||
type | enum | Windows | macOS | |
Type of the port scanning (tcp, udp) |
Last updated