How to find network scanners via stealthwatch

[dijix1990]

Hello, I try to use option from stealthwatch to find network scanners. I started ping scan from my PC. After a while I saw that I have Top Security Event for my host  Ping_Scan with CI = 590,400, after it I went to Report - Visibility Assessment - Internal Network Scanners and found out that there wasn't my host which did ping scan

[David Salter]

Is the IP for your PC included in an Inside Host Group? 

[dijix1990]

yes

[David Salter]

While a host generating a ping scan (and no other behaviors) will accrue CI points and trigger a High Concern Index alarm, it will not appear in the 'Internal Network Scanners' section of the Visibility Assessment.  The Assessment reports on more complex scans where a host is running an address scan or port scan rather than a more simplistic ping sweep.

[dijix1990]

So it's very awful and bad. We need to do some researches to find more reliable product