Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detects when a known security tool performs a scan against your services.
Strategy
The detection rule identifies known security scanners by using common fingerprints associated with the scanners.
The signal severity is set to LOW
because those tools are mostly used during the discovery phase.
The severity is raised to MEDIUM
if multiple distinct security tools are detected. This may indicate broader reconnaissance against your systems.
If the tool discovers a vulnerability, a HIGH
severity signal is emitted.
Triage and response
- Block the attacking IP(s) temporarily to limit vulnerability discovery and service load.
- Review routes targeted, kinds of attacks performed, and possible application errors to assess the attacker’s focus. Datadog Application Vulnerability Management can provide insight into risks of production vulnerabilities.