firewall-banner-change

Overview

• Key: firewall-banner-change

• Name: Firewall Port Banner Changed

• Triggers when: The banner information transmitted by a port is different from the previous scan

Fields

Field	Type	Description
banner	string	Newly identified banner
banner_prior	string	Previous banner
detail	string	Port and protocol where banner was detected
port	integer	Port
protocol	string	Network protocol
scan_id	string	ID of the scan
target_id	integer	ID of the target

Example data

{
  "banner": "Exim smtpd 4.94.2",
  "banner_prior": "Exim smtpd 4.92",
  "detail": "465/tcp",
  "port": 465,
  "protocol": "tcp",
  "scan_id": "202101010000x1Xx2Xx3Xx4Xx5Xx6Xx7",
  "target_id": 123456
}