cscli scenarios install firewallservices/pf-scan-multi_portsDetects TCP port scan : detects if a single IP attempts connection to many different ports.
Leakspeed of 5s, capacity of 15.
1type: leaky2name: firewallservices/pf-scan-multi_ports3description: "Detect aggressive portscans (pf)"4filter: "evt.Meta.log_type == 'pf_drop' && evt.Meta.service == 'tcp'"5groupby: evt.Meta.source_ip6distinct: evt.Parsed.dst_port7capacity: 158leakspeed: 5s9blackhole: 1m10labels:11 service: tcp12 confidence: 013 spoofable: 314 classification:15 - attack.T1595.00116 - attack.T101817 - attack.T104618 behavior: "tcp:scan"19 label: "PF Scan Multi Ports"20 remediation: true21