Commercial vulnerability scanner
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detects when a commercial vulnerability scanner is performing a scan against your services.
Strategy
The detection rule leverages fingerprints from known security companies to identify activity as a commercial scanner.
The signal is set to LOW severity as the occurrence of spoofing commercial vulnerability scanners is rare, but possible. Detection results from authorized vulnerability scans are typically shared with the customer directly from the vendor or vulnerability management team.
Triage and response
Validate that the commercial vulnerability scanner is authorized to scan your systems and the scans are originating from an expected source IP address. Many commercial scans originate from a source IP address published by the vendor.
If the scan is not authorized:
- Block the attacking IP(s) temporarily to limit vulnerability discovery and service load.
- If the scans are originating from a vendor published source IP address, reach out to the vendor to determine the cause of the scan.
