> For the complete documentation index, see [llms.txt](https://docs.elastiflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon/port_scan.md).

# Port Scan

#### Port Scan

Identifying a Port Scan is crucial in the realm of network security, as it often represents the initial stage of reconnaissance in potential cyberattacks. In a port scan, attackers systematically check a host for open ports by sending client requests to multiple ports and observing the responses. Open ports can reveal about active services, potentially unveiling vulnerabilities that could be exploited for unauthorized access or malicious activities. Early detection of port scans is therefore vital for preemptive security measures, allowing network administrators to assess and fortify their defenses, close unnecessary ports, and monitor suspected sources for further suspicious activities.

ElastiFlow provides a collection of anomaly detection jobs designed to identify port scans, including various monitoring strategies and analytical techniques aimed at detecting the distinctive patterns of such reconnaissance activities.

#### Attributes

| Attribute                   | Information                                                                   |
| --------------------------- | ----------------------------------------------------------------------------- |
| **Analysis Type**           | population                                                                    |
| **MITRE ATT\&CK Technique** | [Network Service Scanning (T1046)](https://attack.mitre.org/techniques/T1046) |
| **MITRE ATT\&CK Tactic**    | [Discovery (TA0007)](https://attack.mitre.org/tactics/TA0007)                 |

#### Downloads

| Schema    | Vector          | Perspective  | Window   | Link                                                                                                                                                                                              |
| --------- | --------------- | ------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **CODEX** | **direct**      | **edge**     | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_edge_fast.json)   |
| **CODEX** | **direct**      | **edge**     | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_edge_slow.json)   |
| **CODEX** | **direct**      | **inbound**  | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_in_fast.json)       |
| **CODEX** | **direct**      | **inbound**  | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_in_slow.json)       |
| **CODEX** | **direct**      | **outbound** | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_out_fast.json)     |
| **CODEX** | **direct**      | **outbound** | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_out_slow.json)     |
| **CODEX** | **direct**      | **private**  | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_priv_fast.json)   |
| **CODEX** | **direct**      | **private**  | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_direct\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_direct_priv_slow.json)   |
| **CODEX** | **distributed** | **edge**     | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_edge_fast.json) |
| **CODEX** | **distributed** | **edge**     | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_edge_slow.json) |
| **CODEX** | **distributed** | **inbound**  | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_in_fast.json)     |
| **CODEX** | **distributed** | **inbound**  | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_in_slow.json)     |
| **CODEX** | **distributed** | **outbound** | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_out_fast.json)   |
| **CODEX** | **distributed** | **outbound** | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_out_slow.json)   |
| **CODEX** | **distributed** | **private**  | **fast** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_priv_fast.json) |
| **CODEX** | **distributed** | **private**  | **slow** | [elastiflow\_codex\_netsec\_port\_scan\_distrib\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_recon/netsec_port_scan_distrib_priv_slow.json) |
| **ECS**   | **direct**      | **edge**     | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_edge_fast.json)       |
| **ECS**   | **direct**      | **edge**     | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_edge_slow.json)       |
| **ECS**   | **direct**      | **inbound**  | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_in_fast.json)           |
| **ECS**   | **direct**      | **inbound**  | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_in_slow.json)           |
| **ECS**   | **direct**      | **outbound** | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_out_fast.json)         |
| **ECS**   | **direct**      | **outbound** | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_out_slow.json)         |
| **ECS**   | **direct**      | **private**  | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_priv_fast.json)       |
| **ECS**   | **direct**      | **private**  | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_direct\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_direct_priv_slow.json)       |
| **ECS**   | **distributed** | **edge**     | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_edge_fast.json)     |
| **ECS**   | **distributed** | **edge**     | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_edge_slow.json)     |
| **ECS**   | **distributed** | **inbound**  | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_in_fast.json)         |
| **ECS**   | **distributed** | **inbound**  | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_in_slow.json)         |
| **ECS**   | **distributed** | **outbound** | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_out_fast.json)       |
| **ECS**   | **distributed** | **outbound** | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_out_slow.json)       |
| **ECS**   | **distributed** | **private**  | **fast** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_priv_fast.json)     |
| **ECS**   | **distributed** | **private**  | **slow** | [elastiflow\_ecs\_netsec\_port\_scan\_distrib\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_recon/netsec_port_scan_distrib_priv_slow.json)     |

By deploying this suite of anomaly detection jobs, organizations can effectively identify port scanning activities in their early stages. Prompt detection of port scans allows network administrators to take immediate action, such as reconfiguring firewalls, shutting down unnecessary services, or increasing surveillance on critical assets, thereby enhancing the overall security posture of the network and preventing potential breaches.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_recon/port_scan.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.