Lion Cipher Lab

Detect a port scan from firewall logs and tune the threshold

• SOC Analyst / Blue Team
• Intermediate
• ~60 min
• Free · no account required

Why it matters

A port scan is almost always the first thing an attacker does once they can reach your network: before they can break in, they have to find out what is listening. They sweep one port across many of your hosts to find every box running a vulnerable service (a HORIZONTAL scan), or they hammer many ports on one interesting host to map everything it exposes (a VERTICAL scan). Catching that reconnaissance early -- while the attacker is still knocking on doors rather than walking through one -- is one of the cheapest, highest-leverage detections a SOC can own, and the raw material is a log you…

What you'll learn

• what a port scan is and the two shapes it takes in a log: a HORIZONTAL scan (one source, one port, many hosts) and a VERTICAL scan (one source, one host, many ports)
• reading a firewall / connection log: one row per connection attempt (timestamp, source IP, destination IP, destination port, allow/deny)
• generating a self-contained firewall log as a CSV on your own machine -- benign traffic plus a busy backup server, a monitoring host, and three planted scanners -- so you can hunt without ever scanning anyone
• why raw CONNECTION COUNT is the wrong signal (a busy backup server out-counts a real scanner) and why DISTINCT-host / DISTINCT-port fan-out per source is the right one
• building a sliding-window detector that tracks the maximum distinct destination hosts and ports each source reaches inside any time window
• measuring a detector honestly: computing precision and recall against known ground truth, and reading the precision/recall tradeoff as you move the threshold
• the blind spot every per-source per-window threshold shares -- a low-and-slow scan spread thin enough to never trip the window -- and the real mitigations (longer windows, aggregate by subnet, stateful tools like Zeek or Suricata)

Steps in this lab

1. What a port scan looks like in a log, and the two shapes it takes
2. Generate a self-contained firewall log (nothing is scanned)
3. Build the detector (part 1): a sliding window that measures fan-out per source
4. Build the detector (part 2): flag, then grade yourself with precision and recall
5. The naive round: why raw connection count flags the backup server
6. Tune the threshold: watch precision climb from 0.67 to 1.00
7. The honest negative: the low-and-slow scan that no threshold catches
8. The judgment: when fan-out wins, and how pros ship it

Open the full interactive lab →