> For the complete documentation index, see [llms.txt](https://docs.elastiflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon/port_scan.md).

# Port Scan

#### Port Scan

Identifying a Port Scan is crucial in the realm of network security, as it often represents the initial stage of reconnaissance in potential cyberattacks. In a port scan, attackers systematically check a host for open ports by sending client requests to multiple ports and observing the responses. Open ports can reveal about active services, potentially unveiling vulnerabilities that could be exploited for unauthorized access or malicious activities. Early detection of port scans is therefore vital for preemptive security measures, allowing network administrators to assess and fortify their defenses, close unnecessary ports, and monitor suspected sources for further suspicious activities.

ElastiFlow provides a collection of anomaly detection jobs designed to identify port scans, including various monitoring strategies and analytical techniques aimed at detecting the distinctive patterns of such reconnaissance activities.

#### Attributes

| Attribute                   | Information                                                                   |
| --------------------------- | ----------------------------------------------------------------------------- |
| **Analysis Type**           | population                                                                    |
| **MITRE ATT\&CK Technique** | [Network Service Scanning (T1046)](https://attack.mitre.org/techniques/T1046) |
| **MITRE ATT\&CK Tactic**    | [Discovery (TA0007)](https://attack.mitre.org/tactics/TA0007)                 |

#### Downloads

| Schema    | Vector          | Perspective  | Window   | Link                                                                                                                                                                                              |
| --------- | --------------- | ------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **CODEX** | **direct**      | **edge**     | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_edge_fast.json)   |
| **CODEX** | **direct**      | **edge**     | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_edge_slow.json)   |
| **CODEX** | **direct**      | **inbound**  | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_in_fast.json)       |
| **CODEX** | **direct**      | **inbound**  | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_in_slow.json)       |
| **CODEX** | **direct**      | **outbound** | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_out_fast.json)     |
| **CODEX** | **direct**      | **outbound** | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_out_slow.json)     |
| **CODEX** | **direct**      | **private**  | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_priv_fast.json)   |
| **CODEX** | **direct**      | **private**  | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_priv_slow.json)   |
| **CODEX** | **distributed** | **edge**     | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_edge_fast.json) |
| **CODEX** | **distributed** | **edge**     | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_edge_slow.json) |
| **CODEX** | **distributed** | **inbound**  | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_in_fast.json)     |
| **CODEX** | **distributed** | **inbound**  | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_in_slow.json)     |
| **CODEX** | **distributed** | **outbound** | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_out_fast.json)   |
| **CODEX** | **distributed** | **outbound** | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_out_slow.json)   |
| **CODEX** | **distributed** | **private**  | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_priv_fast.json) |
| **CODEX** | **distributed** | **private**  | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_priv_slow.json) |
| **ECS**   | **direct**      | **edge**     | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_edge_fast.json)       |
| **ECS**   | **direct**      | **edge**     | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_edge_slow.json)       |
| **ECS**   | **direct**      | **inbound**  | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_in_fast.json)           |
| **ECS**   | **direct**      | **inbound**  | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_in_slow.json)           |
| **ECS**   | **direct**      | **outbound** | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_out_fast.json)         |
| **ECS**   | **direct**      | **outbound** | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_out_slow.json)         |
| **ECS**   | **direct**      | **private**  | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_priv_fast.json)       |
| **ECS**   | **direct**      | **private**  | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_priv_slow.json)       |
| **ECS**   | **distributed** | **edge**     | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_edge_fast.json)     |
| **ECS**   | **distributed** | **edge**     | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_edge_slow.json)     |
| **ECS**   | **distributed** | **inbound**  | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_in_fast.json)         |
| **ECS**   | **distributed** | **inbound**  | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_in_slow.json)         |
| **ECS**   | **distributed** | **outbound** | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_out_fast.json)       |
| **ECS**   | **distributed** | **outbound** | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_out_slow.json)       |
| **ECS**   | **distributed** | **private**  | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_priv_fast.json)     |
| **ECS**   | **distributed** | **private**  | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_priv_slow.json)     |

By deploying this suite of anomaly detection jobs, organizations can effectively identify port scanning activities in their early stages. Prompt detection of port scans allows network administrators to take immediate action, such as reconfiguring firewalls, shutting down unnecessary services, or increasing surveillance on critical assets, thereby enhancing the overall security posture of the network and preventing potential breaches.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon/port_scan.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.