Detect Vulnerability Scanning in Splunk

| union
[
  search index=ids sourcetype IN ("suricata", "snort", "bro:notice", "zeek:notice")
      ("SCAN" OR "PROBE" OR "Nessus" OR "Qualys" OR "OpenVAS" OR "Nikto"
       OR "Acunetix" OR "sqlmap" OR "Masscan" OR "Nuclei" OR "gobuster"
       OR "WPScan" OR "dirb" OR "wfuzz" OR "nmap" OR "rustscan" OR "zgrab")
  | eval detection_branch="IDS_Alert"
  | eval src_display=coalesce(src_ip, src)
  | eval sig_display=coalesce(signature, alert.signature, rule_name, category, "-")
  | eval dest_display=coalesce(dest_ip, dest)
  | eval port_display=coalesce(dest_port, 0)
  | stats
      count as alert_count,
      dc(dest_display) as unique_targets,
      dc(sig_display) as unique_signatures,
      values(sig_display) as signatures,
      values(port_display) as dest_ports,
      min(_time) as first_seen,
      max(_time) as last_seen
      by src_display, detection_branch
  | where alert_count >= 3
  | eval scan_intensity=case(
      alert_count >= 200, "Critical",
      alert_count >= 50, "High",
      alert_count >= 10, "Medium",
      true(), "Low")
  | eval duration_minutes=round((last_seen - first_seen) / 60, 1)
]
[
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\nmap.exe" OR Image="*\\masscan.exe" OR Image="*\\nikto*"
       OR Image="*\\nuclei.exe" OR Image="*\\sqlmap*" OR Image="*\\gobuster.exe"
       OR Image="*\\wpscan*" OR Image="*\\ffuf.exe" OR Image="*\\feroxbuster.exe"
       OR Image="*\\rustscan.exe" OR Image="*\\dirb*" OR Image="*\\wfuzz*"
       OR CommandLine="*--script vuln*" OR CommandLine="*-p 1-65535*"
       OR CommandLine="*masscan --rate*" OR CommandLine="*nuclei -t cves*"
       OR CommandLine="*nikto -h*" OR CommandLine="*gobuster dir*"
       OR CommandLine="*ffuf -w*" OR CommandLine="*--top-ports*")
  | eval detection_branch="InternalScanner"
  | eval src_display=host
  | eval sig_display=Image
  | eval unique_targets=1
  | eval scan_intensity="Medium"
  | stats
      count as alert_count,
      dc(host) as unique_targets,
      dc(sig_display) as unique_signatures,
      values(sig_display) as signatures,
      values(CommandLine) as dest_ports,
      min(_time) as first_seen,
      max(_time) as last_seen
      by src_display, detection_branch, User
  | eval duration_minutes=round((last_seen - first_seen) / 60, 1)
]
| table first_seen, last_seen, duration_minutes, src_display, scan_intensity,
         alert_count, unique_targets, unique_signatures, signatures,
         dest_ports, detection_branch
| sort - alert_count