このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detects when a known security tool performs a scan against your services.
Strategy
The detection rule identifies known security scanners by using common fingerprints associated with the scanners.
The signal severity is set to LOW because those tools are mostly used during the discovery phase.
The severity is raised to MEDIUM if multiple distinct security tools are detected. This may indicate broader reconnaissance against your systems.
If the tool discovers a vulnerability, a HIGH severity signal is emitted.
Triage and response
- Block the attacking IP(s) temporarily to limit vulnerability discovery and service load.
- Review routes targeted, kinds of attacks performed, and possible application errors to assess the attacker’s focus. Datadog Application Vulnerability Management can provide insight into risks of production vulnerabilities.
