Catch the port scanner, not the busy hosts
A firewall log shows one host probing many ports in seconds, mixed with normal traffic. Write a threshold rule that flags the scanner without alerting on busy-but-benign hosts.
Scenario
The firewall log shows blocked connection attempts. One source, 203.0.113.66, rattled through a
long list of ports in a few seconds, a port scan. The other sources are ordinary hosts that made a
handful of connections.
You write detection rules. Author a threshold rule that flags the scanner and leaves the busy hosts alone.
Rule format (detection.yml)
match: a substring every relevant log line containsgroup_by: the field to count per (src_ip)threshold: how many matching events from one source trips the alertwindow_seconds: the time window the count is measured over
Your job
Tune detection.yml so the count threshold is high enough to clear the benign hosts (a few
connections each) but low enough to catch the scanner (many in seconds).
What "done" looks like
The rule alerts on 203.0.113.66 and on no other source.
Graded by running your rule against a fixed log sample.
Teaches: threshold detection and false-positive tuning: a scan is a rate signal (many events from one source in a short window), and the threshold is what separates it from normal load.
What gets checked
Your solution is verified against each of these:
- The detection rule is well-formed (match, group_by, threshold, window)
- The rule flags the scanning source
- No benign host is flagged
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.