Network Reconnaissance Activity Detected

Ankit Mehta@Secvyn

•updated Jun 12, 2026•1•0•5

This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.