# Reconnaissance

Network reconnaissance is a preliminary stage often used by cyberattackers to gather information about a network for vulnerabilities that can be exploited in subsequent attacks. This phase involves scanning network resources, identifying active machines, and discovering services or open ports. Identifying network reconnaissance activities is crucial as it serves as an early warning system, allowing network administrators to detect potential threats before they escalate into full-blown cyberattacks. Proactive detection of these activities can lead to timely defensive measures, such as strengthening network defenses and addressing identified vulnerabilities, thereby enhancing the overall security posture of the network.

ElastiFlow provides a collection of anomaly detection jobs designed to identify network reconnaissance activities that plays a vital role in this early detection process. These jobs leverage sophisticated monitoring and analytics techniques to scrutinize network traffic and logs for patterns indicative of reconnaissance.

#### Downloads

| Schema    | Link                                                                                                                                                         |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **CODEX** | [All Reconnaissance ML Jobs for CODEX Schema](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_recon.json) |
| **ECS**   | [All Reconnaissance ML Jobs for ECS Schema](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_recon.json)     |

By deploying this suite of anomaly detection jobs, organizations can effectively monitor for and identify signs of network reconnaissance. This early detection enables network administrators to take preemptive actions, such as reconfiguring firewalls, updating access control policies, and reinforcing network security measures. Identifying reconnaissance activities is a critical step in thwarting cyberattacks in their early stages, helping to maintain the security and integrity of network infrastructures.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.