Skip to main content
Version: 6.4

Reconnaissance

Network reconnaissance is a preliminary stage often used by cyber attackers to gather information about a network for vulnerabilities that can be exploited in subsequent attacks. This phase involves scanning network resources, identifying active machines, and discovering services or open ports. Identifying network reconnaissance activities is crucial as it serves as an early warning system, allowing network administrators to detect potential threats before they escalate into full-blown cyber attacks. Proactive detection of these activities can lead to timely defensive measures, such as strengthening network defenses and addressing identified vulnerabilities, thereby enhancing the overall security posture of the network.

ElastiFlow provides a collection of anomaly detection jobs designed to identify network reconnaissance activities plays a vital role in this early detection process. These jobs leverage sophisticated monitoring and analytics techniques to scrutinize network traffic and logs for patterns indicative of reconnaissance.

Downloads​

SchemaLink
CODEXAll Reconnaissance ML Jobs for CODEX Schema
ECSAll Reconnaissance ML Jobs for ECS Schema

By deploying this suite of anomaly detection jobs, organizations can effectively monitor for and identify signs of network reconnaissance. This early detection enables network administrators to take preemptive actions, such as reconfiguring firewalls, updating access control policies, and reinforcing network security measures. Identifying reconnaissance activities is a critical step in thwarting cyber attacks in their early stages, helping to maintain the security and integrity of network infrastructures.