Goal

Detects when a known security tool performs a scan against your services.

Strategy

The detection rule identifies known security scanners by using common fingerprints associated with the scanners.

The signal severity is set to LOW because those tools are mostly used during the discovery phase.

The severity is raised to MEDIUM if multiple distinct security tools are detected. This may indicate broader reconnaissance against your systems.

If the tool discovers a vulnerability, a HIGH severity signal is emitted.

Triage and response

1. Block the attacking IP(s) temporarily to limit vulnerability discovery and service load.
2. Review routes targeted, kinds of attacks performed, and possible application errors to assess the attacker’s focus. Datadog Application Vulnerability Management can provide insight into risks of production vulnerabilities.