Internal Network Scanning Activity Detected
Detects an internal source IP that has communicated with a high number of unique destination IP addresses and ports within a 24-hour period. This behavior is indicative of network reconnaissance or internal port scanning.
Microsoft Sentinel (KQL)
