1type: leaky
2name: firewallservices/pf-scan-multi_ports
3description: "Detect aggressive portscans (pf)"
4filter: "evt.Meta.log_type == 'pf_drop' && evt.Meta.service == 'tcp'"
5groupby: evt.Meta.source_ip
6distinct: evt.Parsed.dst_port
7capacity: 15
8leakspeed: 5s
9blackhole: 1m
10labels:
11  service: tcp
12  confidence: 1
13  spoofable: 3
14  classification:
15    - attack.T1595.001
16    - attack.T1018
17    - attack.T1046
18  behavior: "tcp:scan"
19  label: "PF Scan Multi Ports"
20  remediation: true
21