↳ GitHub sourceAnalytics ruleLow
CloudNGFW By Palo Alto Networks - possible internal to external port scanning
An inconsistency was detected in the sources: variants or an invalid file. Check the files and commit shown below.
Description
'Identifies a list of internal Source IPs (10.x.x.x Hosts) that have triggered 10 or more non-graceful tcp server resets from one or more Destination IPs which results in an "app = incomplete" designation. The server resets coupled with an "Incomplete" app designation can be an indication of internal to external port scanning or probing attack.
References: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUvCAK
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTaCAK'
- Rule type
- Scheduled
- Version
- 1.0.6
- Declared status
- Available
- Query frequency
- 1h
- Query period
- 1h
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
fluentbit_CL
| where ident_s == "TRAFFIC"
| where isnotempty(FirewallName_s)
| extend message = parse_json(Message)
| extend DestinationPort = tostring(message.dport)
| extend SourceIP = tostring(message.src_ip)
| extend DestinationIP = tostring(message.dst_ip)
| extend Application = tostring(message.app)
| extend Protocol = tostring(message.proto)
| extend Action = tostring(message.action)
| where isnotempty(DestinationPort) and message.action !in ("reset-both", "deny")
| where DestinationPort !in ("443", "53", "389", "80", "0", "880", "8888", "8080")
| where message.app == "incomplete"
| where toint(DestinationPort) !between (49512 .. 65535)
| where message.dst_ip !startswith "10."
| extend Reason = coalesce(column_ifexists("Reason", ""), tostring(message.session_end_reason), "")
| where Reason !has "aged-out"
| where Reason !has "tcp-fin"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by FirewallName_s, SourceIP, Application, Reason, DestinationPort, Protocol, ident_s, Action, DestinationIP
| where count_ >= 10
| summarize StartTime = min(StartTime), EndTime = max(EndTime), makeset(DestinationIP), totalcount = sum(count_) by FirewallName_s, SourceIP, Application, Reason, DestinationPort, Protocol, ident_s, Action
| extend IPAddress = SourceIP
| extend HostName = tostring(split(FirewallName_s, ".")[0]), DomainIndex = toint(indexof(FirewallName_s, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(FirewallName_s, DomainIndex + 1), FirewallName_s)
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
5b72f527-e3f6-4a00-9908-8e4fee14da9f
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC