OpenVAS Vulnerability Scanner Traffic Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects network traffic generated by the OpenVAS vulnerability scanner. It specifically looks for HTTP requests where the User-Agent header contains the string "OpenVAS" (case-insensitive). This indicates that an OpenVAS scanner is actively probing the network, which could be part of a legitimate security assessment or a malicious reconnaissance effort.