> For the complete documentation index, see [llms.txt](https://docs.elastiflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon.md).

# Reconnaissance

Network reconnaissance is a preliminary stage often used by cyberattackers to gather information about a network for vulnerabilities that can be exploited in subsequent attacks. This phase involves scanning network resources, identifying active machines, and discovering services or open ports. Identifying network reconnaissance activities is crucial as it serves as an early warning system, allowing network administrators to detect potential threats before they escalate into full-blown cyberattacks. Proactive detection of these activities can lead to timely defensive measures, such as strengthening network defenses and addressing identified vulnerabilities, thereby enhancing the overall security posture of the network.

ElastiFlow provides a collection of anomaly detection jobs designed to identify network reconnaissance activities that plays a vital role in this early detection process. These jobs leverage sophisticated monitoring and analytics techniques to scrutinize network traffic and logs for patterns indicative of reconnaissance.

#### Downloads

| Schema    | Link                                                                                                                                                         |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **CODEX** | [All Reconnaissance ML Jobs for CODEX Schema](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_recon.json) |
| **ECS**   | [All Reconnaissance ML Jobs for ECS Schema](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_recon.json)     |

By deploying this suite of anomaly detection jobs, organizations can effectively monitor for and identify signs of network reconnaissance. This early detection enables network administrators to take preemptive actions, such as reconfiguring firewalls, updating access control policies, and reinforcing network security measures. Identifying reconnaissance activities is a critical step in thwarting cyberattacks in their early stages, helping to maintain the security and integrity of network infrastructures.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.