Environment
- Carbon Black Cloud Console: All Versions
- Carbon Black Cloud Sensor: All Supported Versions
Question
How Can An External Host Be Considered A scanning Host?
Answer
The scanning host determination is made on an endpoint with an installed sensor and which is receiving the connection requests. The sensor tracks recent received connections from the same originating IP to multiple ports and flags the next connection request once the number becomes high enough to be considered suspicious
Related Content
