Potential Reconnaissance Activity by Bots/Scanners

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•3

This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.