MELTr
Home Vendors Search Download
Login
Vendors / SCADAfence / SCADAfence Platform / Network Scanner Detection Alert
SCADAfence logo

Event type

Network Scanner Detection Alert

OT/ICS security alert for detected scanning activity

Alert generated when the SCADAfence Platform detects network scanning activity from an asset, indicating potential reconnaissance or malicious behavior in OT/ICS environments

CEF 17 fields Medium Generator

security threat-detection ot-security scanning reconnaissance cef
Preview Sample View Schema
CLI Install
meltr templates install scadafence

Overview

What this event covers

Alert generated when an asset is identified as performing network scanning activity, sending requests to multiple assets/ports in the OT network

When generated

  • ›When an asset scans multiple IP addresses or ports in a short time period
  • ›When reconnaissance patterns are detected in OT network traffic
  • ›When potentially malicious scanning activity is observed
  • ›When legitimate scanning tools are detected (management platforms)

Security relevance

High

Compliance

NIST CSF (Detect) IEC 62443 (Industrial Automation Security) NERC CIP ISA/IEC 62443

Frequency notes

Medium frequency - approximately 8-12 alerts per hour during normal operations. Higher frequency during night hours when unauthorized scanning may occur (2.0x multiplier). Lower on weekends (0.3x) as legitimate management activities decrease.

Resources

Docs and tools

SCADAfence Platform Documentation official CEF Format Specification reference ICS/OT Security Best Practices reference SCADAfence Platform OT/ICS security monitoring and threat detection platform NIST Cybersecurity Framework Framework for managing OT/ICS cybersecurity risks

Generation

Configuration

Base frequency
8 events/hour
Time patterns
business_hours night_hours weekend
Business hours
1.5x
Night hours
2.0x
Weekend
0.3x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

CEF Version
Integer Required

CEF format version (always 0)

Source: Static value: 0

Format Integer
Example 0
Device Vendor
String Required

Vendor of the security device generating the alert

Source: Static value: SCADAfence

Example SCADAfence
Device Product
String Required

Product name of the security platform

Source: Static value: SCADAfence Platform

Example SCADAfence Platform
Device Version
String Required

Version of the SCADAfence Platform

Source: random_weighted() - weighted selection from common versions

Format Semantic version
Example 6.5.1.15
Values
  • 6.5.1.15 Version 6.5.1.15 (50% probability)
  • 6.6.0.8 Version 6.6.0.8 (30% probability)
  • 6.7.2.3 Version 6.7.2.3 (20% probability)
Signature ID
Integer Required

Alert type identifier for network scanner detection

Source: Static value: 1200

Example 1200
Name
String Required

Human-readable name of the alert type

Source: Static value: Network Scanner was detected

Example Network Scanner was detected
Severity
Integer Required

Alert severity level (CEF severity scale 0-10)

Source: random_weighted() - 8 (60%), 7 (30%), 9 (10%)

Format Integer 0-10
Example 8
Values
  • 7 High severity (30% of alerts)
  • 8 Very high severity (60% of alerts)
  • 9 Critical severity (10% of alerts)
alert_ip
String Required

IP address of the asset performing scanning activity

Source: registry.get_random_device().ip_address - from entity registry

Format IPv4
Example 192.168.1.51
site
String Required

Physical site or facility where the scanning asset is located

Source: random_weighted() - site assignments or N/A

Example Plant-A
Values
  • N/A No site assigned (40%)
  • Plant-A Plant A facility (20%)
  • Facility-B Facility B (20%)
  • Site-1 Site 1 (20%)
alert_seq
Integer Required

Unique sequential alert identifier

Source: random_int(1, 99999) - unique alert ID

Format Integer
Example 81
status
String Required

Current status of the alert in the workflow

Source: random_weighted() - alert lifecycle status

Example CREATED
Values
  • CREATED Newly created alert (40%)
  • IN_PROGRESS Alert under investigation (30%)
  • RESOLVED Alert resolved (20%)
  • ACKNOWLEDGED Alert acknowledged by analyst (10%)
createdOn
DateTime Required

Timestamp when the alert was first created

Source: created_time | format_datetime() - current time minus random offset

Format YYYY-MM-DD HH:MM:SS
Example 2021-09-13 20:40:20
updatedOn
DateTime Required

Timestamp of the last update to the alert

Source: updated_time | format_datetime() - recent update time

Format YYYY-MM-DD HH:MM:SS
Example 2021-09-13 20:41:16
details
String Required

Detailed description of the detected scanning activity

Source: Dynamically constructed with alert_ip from device registry

Example Asset 192.168.1.51 was identified as a network scanner, sending requests to too many assets/ports
explanation
String Required

Technical explanation of why this activity is concerning and what it might indicate

Source: Static guidance text for this alert type

Example This asset has been identified as doing scanning activity...
remediation
String Required

Recommended remediation steps for security analysts

Source: Static remediation guidance for this alert type

Example Please check the asset. If it is a valid scanner...
url
String Required

Direct URL to view the alert in the SCADAfence Platform UI

Source: Constructed from platform_ip and alert_seq

Format URL
Example https://192.168.1.234/alerts/81