> For the complete documentation index, see [llms.txt](https://docs.elastiflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon.md).

# Reconnaissance

Network reconnaissance is a preliminary stage often used by cyberattackers to gather information about a network for vulnerabilities that can be exploited in subsequent attacks. This phase involves scanning network resources, identifying active machines, and discovering services or open ports. Identifying network reconnaissance activities is crucial as it serves as an early warning system, allowing network administrators to detect potential threats before they escalate into full-blown cyberattacks. Proactive detection of these activities can lead to timely defensive measures, such as strengthening network defenses and addressing identified vulnerabilities, thereby enhancing the overall security posture of the network.

ElastiFlow provides a collection of anomaly detection jobs designed to identify network reconnaissance activities that plays a vital role in this early detection process. These jobs leverage sophisticated monitoring and analytics techniques to scrutinize network traffic and logs for patterns indicative of reconnaissance.

#### Downloads

| Schema    | Link                                                                                                                                                         |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **CODEX** | [All Reconnaissance ML Jobs for CODEX Schema](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_recon.json) |
| **ECS**   | [All Reconnaissance ML Jobs for ECS Schema](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_recon.json)     |

By deploying this suite of anomaly detection jobs, organizations can effectively monitor for and identify signs of network reconnaissance. This early detection enables network administrators to take preemptive actions, such as reconfiguring firewalls, updating access control policies, and reinforcing network security measures. Identifying reconnaissance activities is a critical step in thwarting cyberattacks in their early stages, helping to maintain the security and integrity of network infrastructures.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.