Detection of Scanning

[Jhun Banzuela]

Hi,

Question 1:

From which signature in reconnaissance can detect scanning such as nmap or qualys.?

I performed scan but none is detected. I think it is not just enabled.

Question 2:

I may allow scanning from time to time but with source address defined.

How can I whitelist an IP for scanning purpose.?

Regards,

Jhun

[Ravi Singh]

You can use the below signature to detect NMAP

https://intellishield.cisco.com/security/alertmanager/ipsSignature?signatureId=3046&signatureSubId=0