detecting-network-scanning-with-ids-signatures

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures.

954|172|Updated Mar 13, 2026

Search Tags:#network security #threat detection #port scanning #IDs #suricata #snort #nmap detection

One-click install

npx skills add https://github.com/xalgord/xalgorix --skill detecting-network-scanning-with-ids-signatures

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: detecting-network-scanning-with-ids-signatures
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/detecting-network-scanning-with-ids-signatures
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-network-scanning-with-ids-signatures

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams often miss early-stage reconnaissance because scanners like Nmap and Masscan blend into normal traffic, and naive threshold rules silently fail against slow, decoy, or IPv6 scans. This Skill provides production-ready IDS signatures, threshold configurations, and alert correlation logic to reliably surface scanning activity before exploitation begins.

Core Features & Use Cases

Signature-Based Scan Detection: Deploy Suricata/Snort rules covering SYN, FIN, Xmas, NULL, ACK, UDP, and Nmap-specific probes including OS fingerprinting and NSE scripts.
Threshold and Suppression Tuning: Configure threshold.config with rate filters and suppressions for authorized vulnerability scanners to reduce alert flooding.
Alert Correlation and Reporting: Analyze Suricata eve.json logs with a Python script that groups alerts by source, classifies scan types, and assigns severity based on internal versus external origin.
Use Case: A SOC analyst investigating suspicious traffic loads the scan-detection rules into Suricata, then runs the analysis script against eve.json to identify an internal host performing a SYN sweep across 50 targets, flagging it as a critical lateral-movement indicator.

Quick Start

Deploy the provided Suricata scan-detection rules and analyze the eve.json alert log to identify and report network scanning sources.

Frequently Asked Questions about detecting-network-scanning-with-ids-signatures

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What are the limitations of signature-based scan detection?▼

Fragmented probes, source-port spoofing, decoy scans, and idle scans bypass flag-based signatures. Confirm real scans by correlating alerts with follow-on exploitation attempts or checking for SYN bursts without SYN/ACK replies in eve.json flow records.