NMAP - Single Port Scan

Sub-playbook that conducts a single port Nmap scan and returns the results to the parent playbook.

Nmap · 10 tasks · 3 inputs · 3 outputs

Inputs

  • RemoteIP — Remote IP address in an incident/alert.
  • RemotePort — Remote port number in an incident/alert.
  • NMAPOptions — Options to be used for the Nmap scan. (We do "-p<RemotePort>" by default and recommend using "-Pn" to skip a ping check.)

Outputs

  • ScanResult — The result of the scan (if done).
  • ScanDone — Whether a scan was actually performed (based on subtypes).
  • NMAP — NMAP scan data

Commands used

nmap-scan

Flowchart

yes down/closed open Start Start NMAP port scan - nmap-scan NMAP port scan nmap-scan No scan done No scan done Complete Complete Is NMAP enabled? Is NMAP enabled? Scan done Scan done What is the result of the scan? What is the result of the... Closed scan result Closed scan result Open scan result Open scan result Undetermined scan result Undetermined scan result