Port Scan
Port Scan Incident
Details
| ID | Port Scan |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.0.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Port Scan 8 sections
Involved Files
Files that were involved with the port scan. These may be the files that created the port scan alert.
| Field ID | Position |
|---|---|
| filename | Col 0-2, Height: 24 |
| filehash | Col 0-2, Height: 24 |
Scan Source
Information about the source of the scan
| Field ID | Position |
|---|---|
| sourceip | Col 0-2, Height: 24 |
| sourcehostname | Col 0-2, Height: 24 |
| sourceusername | Col 0-2, Height: 24 |
| country | Col 0-2, Height: 24 |
Investigation Properties
Information on the type, stage and scope of the incident. Subject to change throughout the investigation.
| Field ID | Position |
|---|---|
| severity | Col 0-2, Height: 24 |
| scansourcetype | Col 0-2, Height: 24 |
| niststage | Col 0-2, Height: 24 |
| owner | Col 0-2, Height: 24 |
User Contact Details
This information is only relevant for an internal port scan where the username is available as part of the alert
| Field ID | Position |
|---|---|
| employeedisplayname | Col 0-2, Height: 24 |
| employeemanageremail | Col 0-2, Height: 24 |
| employeeemail | Col 0-2, Height: 24 |
Pivoted Entities
Additional entities potentially involved with the scan. This includes hostnames that were found associated with the file that initiated the scan (internal), domain names that were hosted on the IP (external scan) and more.
| Field ID | Position |
|---|---|
| infectedhostnames | Col 0-2, Height: 55 |
| associatedmaliciousdomains | Col 0-2, Height: 55 |
Actions Taken
Actions that were taken automatically to contain the incident. If containment and remediation steps are taken manually - these fields have to be updated manually.
| Field ID | Position |
|---|---|
| attackerhostisolated | Col 0-2, Height: 55 |
| attackeripblocked | Col 0-2, Height: 55 |
| filehashblocked | Col 0-2, Height: 55 |
| maliciousdomainsblocked | Col 0-2, Height: 55 |
Scan Destination
Information about the target of the scan.
| Field ID | Position |
|---|---|
| destinationports | Col 0-2, Height: 24 |
| destinationip | Col 0-2, Height: 24 |
| numberofports | Col 0-2, Height: 24 |
| numberofuniqueports | Col 0-2, Height: 24 |
Incident Metadata 11 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 24 |
| severity | Col 0-2, Height: 24 |
| owner | Col 0-2, Height: 24 |
| dbotsource | Col 0-2, Height: 24 |
| sourcebrand | Col 0-2, Height: 24 |
| sourceinstance | Col 0-2, Height: 24 |
| playbookid | Col 0-2, Height: 24 |
Notes
Work Plan
Linked Incidents
Child Incidents
Evidence
Team Members
Indicators
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-1, Height: 24 |
| dbotmodified | Col 0-1, Height: 24 |
| dbotduedate | Col 0-2, Height: 24 |
| dbotcreated | Col 1-2, Height: 24 |
| dbotclosed | Col 1-2, Height: 24 |
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 24 |
| closereason | Col 0-2, Height: 24 |
| closenotes | Col 0-2, Height: 24 |
Investigation Data
| Field ID | Position |
|---|---|
| details | Col 0-2, Height: 24 |
Work Plan 0 sections
No sections defined.
War Room 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.