> For the complete documentation index, see [llms.txt](https://docs.halosecurity.com/api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.halosecurity.com/api/events-archive/firewall-banner-change.md).

# firewall-banner-change

### Overview

* **Key:** `firewall-banner-change`
* **Name:** Firewall Port Banner Changed
* **Triggers when:** The banner information transmitted by a port is different from the previous scan

### Fields

| Field         | Type    | Description                                 |
| ------------- | ------- | ------------------------------------------- |
| banner        | string  | Newly identified banner                     |
| banner\_prior | string  | Previous banner                             |
| detail        | string  | Port and protocol where banner was detected |
| port          | integer | Port                                        |
| protocol      | string  | Network protocol                            |
| scan\_id      | string  | ID of the scan                              |
| target\_id    | integer | ID of the target                            |

### Example data

```json
{
  "banner": "Exim smtpd 4.94.2",
  "banner_prior": "Exim smtpd 4.92",
  "detail": "465/tcp",
  "port": 465,
  "protocol": "tcp",
  "scan_id": "202101010000x1Xx2Xx3Xx4Xx5Xx6Xx7",
  "target_id": 123456
}
```