Active IP Block Scan Detected
Detects high-volume TCP SYN scanning across IP blocks indicating active reconnaissance
Microsoft Sentinel (KQL)

Detects high-volume TCP SYN scanning across IP blocks indicating active reconnaissance

Already have an account?