Details
| ID | nmap |
|---|---|
| Provider | Open Source |
| Category | Network Security |
| From Version | 5.0.0 |
| Docker Image | demisto/netutils:1.0.0.10187688 |
| Supported Modules | Agentix XSIAM |
README
Run nmap scans with the given parameters.
This integration was integrated and tested with version 7.70 of nmap. The nmap binary is shipped with the integration Docker. You can see the options available for running an nmap scan here: https://nmap.org/book/man-briefoptions.html. Some scan options require root access for using raw packet scanning techniques. See here for detailed scanning techniques. If you’ve configured the server to run Docker images with a non-root internal user and you want to use raw packet scanning (for example via the -sS option for SYN/ACK scan), make sure to exclude the demisto/nmap Docker image as documented For Cortex XSOAR 6 here. For Cortex XSOAR 8 Cloud here. For Cortex XSOAR 8.7 On-prem here.
Configure nmap in Cortex
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
nmap-scan
Scan targets with the given parameters.
Base Command
nmap-scan
Input
| Argument Name | Description | Required |
|---|---|---|
| targets | The targets to scan. Accepts comma-separated list. | Required |
| options | The nmap options to use as documented by nmap. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| NMAP.Scan.Summary | unknown | Scan summary. |
| NMAP.Scan.Version | unknown | nmap version. |
| NMAP.Scan.Started | unknown | Start time epoch. |
| NMAP.Scan.Ended | unknown | End time epoch. |
| NMAP.Scan.CommandLine | unknown | The command line being used. |
| NMAP.Scan.ScanType | unknown | The type of discovery scan. |
| NMAP.Scan.Hosts.Hostname | unknown | DNS hostname of scanned host. |
| NMAP.Scan.Hosts.Address | unknown | Scanned host address. |
| NMAP.Scan.Hosts.Status | unknown | Is the host up or down. |
| NMAP.Scan.Hosts.Services.Port | unknown | The port of the service. |
| NMAP.Scan.Hosts.Services.Protocol | unknown | The protocol of the service. |
| NMAP.Scan.Hosts.Services.State | unknown | The state of the service. |
| NMAP.Scan.Hosts.Services.Banner | unknown | Any captured banner from the service. |
| NMAP.Scan.Hosts.Services.Service | unknown | The service name. |
| NMAP.Scan.Hosts.ScriptResults.ID | unknown | The name of the script used. |
| NMAP.Scan.Hosts.ScriptResults.Output | unknown | The raw results of the script execution. |
| NMAP.Scan.Hosts.ScriptResults.Elements | unknown | Additional parseable fields from the script output. |
Command Example
!nmap-scan options="-sV" targets=scanme.nmap.org
Context Example
{
"NMAP": {
"Scan": {
"CommandLine": "/usr/bin/nmap -oX - -vvv --stats-every 1s -sV scanme.nmap.org",
"Ended": 1588340465,
"Hosts": [
{
"Address": "45.33.32.156",
"Hostname": "scanme.nmap.org",
"Services": [
{
"Banner": "",
"Port": 21,
"Protocol": "tcp",
"Service": "tcpwrapped",
"State": "open"
},
{
"Banner": "product: OpenSSH version: 6.6.1p1 Ubuntu 2ubuntu2.13 extrainfo: Ubuntu Linux; protocol 2.0 ostype: Linux",
"Port": 22,
"Protocol": "tcp",
"Service": "ssh",
"State": "open"
},
{
"Banner": "product: Apache httpd version: 2.4.7 extrainfo: (Ubuntu)",
"Port": 80,
"Protocol": "tcp",
"Service": "http",
"State": "open"
},
{
"Banner": "",
"Port": 1723,
"Protocol": "tcp",
"Service": "tcpwrapped",
"State": "open"
},
{
"Banner": "",
"Port": 5060,
"Protocol": "tcp",
"Service": "sip",
"State": "open"
},
{
"Banner": "product: Nping echo",
"Port": 9929,
"Protocol": "tcp",
"Service": "nping-echo",
"State": "open"
},
{
"Banner": "",
"Port": 31337,
"Protocol": "tcp",
"Service": "tcpwrapped",
"State": "open"
}
],
"Status": "up"
}
],
"ScanType": "connect",
"Started": 1588340281,
"Summary": "Nmap done at Fri May 1 13:41:05 2020; 1 IP address (1 host up) scanned in 183.98 seconds",
"Version": "7.70"
}
}
}
Human Readable Output
Nmap done at Fri May 1 13:41:05 2020; 1 IP address (1 host up) scanned in 183.98 seconds
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up
Services
Port Protocol State Service Banner 21 tcp open tcpwrapped 22 tcp open ssh product: OpenSSH version: 6.6.1p1 Ubuntu 2ubuntu2.13 extrainfo: Ubuntu Linux; protocol 2.0 ostype: Linux 80 tcp open http product: Apache httpd version: 2.4.7 extrainfo: (Ubuntu) 1723 tcp open tcpwrapped 5060 tcp open sip 9929 tcp open nping-echo product: Nping echo 31337 tcp open tcpwrapped
Commands (1)
-
nmap-scanScan targets with the given parameters.
sectionorder: - Connect - Collect commonfields: id: nmap version: -1 name: nmap display: nmap category: Network Security provider: Open Source description: Run nmap scans with the given parameters. configuration: [] fromversion: 5.0.0 script: script: '' type: python subtype: python3 commands: - name: nmap-scan arguments: - name: targets required: true description: The targets to scan. Accepts comma-separated list. - name: options required: true description: The nmap options to use as documented by nmap. outputs: - contextPath: NMAP.Scan.Summary description: Scan summary. - contextPath: NMAP.Scan.Version description: nmap version. - contextPath: NMAP.Scan.Started description: Start time epoch. - contextPath: NMAP.Scan.Ended description: End time epoch. - contextPath: NMAP.Scan.CommandLine description: The command line being used. - contextPath: NMAP.Scan.ScanType description: The type of discovery scan. - contextPath: NMAP.Scan.Hosts.Hostname description: DNS hostname of scanned host. - contextPath: NMAP.Scan.Hosts.Address description: Scanned host address. - contextPath: NMAP.Scan.Hosts.Status description: Is the host up or down. - contextPath: NMAP.Scan.Hosts.Services.Port description: The port of the service. - contextPath: NMAP.Scan.Hosts.Services.Protocol description: The protocol of the service. - contextPath: NMAP.Scan.Hosts.Services.State description: The state of the service. - contextPath: NMAP.Scan.Hosts.Services.Banner description: Any captured banner from the service. - contextPath: NMAP.Scan.Hosts.Services.Service description: The service name. - contextPath: NMAP.Scan.Hosts.ScriptResults.ID description: The name of the script used. - contextPath: NMAP.Scan.Hosts.ScriptResults.Output description: The raw results of the script execution. - contextPath: NMAP.Scan.Hosts.ScriptResults.Elements description: Additional parseable fields from the script output. description: Scan targets with the given parameters. execution: true dockerimage: demisto/netutils:1.0.0.10187688 tests: - No tests (auto formatted)