Someone has scanned the network

Hi,

from inside or outside? Please review logviewer the entries there will show you the source.

ian

Hi,

From outside.

Yes I know, but the scope would be vast. So I want to know how to narrow my scope so that I can get the outside scanning details and accordingly take action. If you suggest log viewer how to filter my requirement.?

You can use XDR for this kind of analyse: https://community.sophos.com/intercept-x-endpoint/i/network/port-scan-detection-using-sophos-firewall-data-in-the-data-lake

You can use XDR for this kind of analyse: https://community.sophos.com/intercept-x-endpoint/i/network/port-scan-detection-using-sophos-firewall-data-in-the-data-lake