$ALERT=PORTSCAN
$LANG=en
$CHARSET=UTF-8
$DESC=Text/Formatted HTML (English)

#Template for portscanning alert

[TEMPLATE]
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="b1_1a3d3c1c94034170d350a084d91d8dc4"


--b1_1a3d3c1c94034170d350a084d91d8dc4
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Portscan detected

Host:  $HOSTNAME$ ($HOSTIP$)
Details:  $LOG$


Alert description:

	A portscan is an attempt by an attacker to enumerate the services running on a machine by probing each port for a response. This is an attempt by an intruder to determine how best to attack a system. By determining which services are running on a host, an intruder can direct an attack more effectively, reducing the amount of time and effort required to gain unauthorized access. There are many legitimate applications (e.g., FTP) that can appear to be a portscan. Therefore, you should investigate the initial events to determine whether they were legitimate or not.

----------------------------------------------------------------------------
This message is automatically generated by Kerio WinRoute Firewall ($FIREWALL$),
please do not reply to this e-mail.
$TIME$

--b1_1a3d3c1c94034170d350a084d91d8dc4
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: 8bit

<?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<style>
body { margin: 0; padding: 0; font-family: verdana, tahoma, sans-serif; font-size: 8pt; text-align: left; background: #FFFFFF; color: #989898; }
h1 { color: #FF6810; font-size: 17.5pt; font-weight: bold; padding: 0; margin: 15px 0 20px 0; }
h2 { font-size: 10.5pt; font-weight: bold; margin-top: 15px; }
table { font-size: 8pt; border-collapse: collapse; border-spacing: 0; }
table th { background: #B8B8F0; border: 3px solid #FFF; color: #FFF; font-weight: normal; text-align: center; padding: 3px; }
table td { background: #E8E4F8; border: 3px solid #FFF; color: #7880A8; text-align: left; padding: 3px; }
p { margin-left: 20px; margin-top: 5px; text-align: justify; }
</style>
</head>

<body>
<div style=" width: 500; margin-left: 40px;">
 <h1>Portscan detected</h1>
 <table>
  <tr><th colspan="2">Event description</th></tr>
  <tr><td><b>Host:</b></td><td>$HOSTNAME$ ($HOSTIP$)</td></tr>
  <tr><td><b>Details:</b></td><td>$LOG$</td></tr>
 </table>

<h2>Alert description:</h2>

<p>A portscan is an attempt by an attacker to enumerate the services running on a machine by probing each port for a response. This is an attempt by an intruder to determine how best to attack a system. By determining which services are running on a host, an intruder can direct an attack more effectively, reducing the amount of time and effort required to gain unauthorized access. There are many legitimate applications (e.g., FTP) that can appear to be a portscan. Therefore, you should investigate the initial events to determine whether they were legitimate or not.
</p>

 <div style="font-size: 7pt;  margin: 20px 0 0 0;">
 This message is automatically generated by Kerio WinRoute Firewall ($FIREWALL$), 
 <br>please do not reply to this e-mail.<br>
 $TIME$
 </div>
</div>
</body></html>

--b1_1a3d3c1c94034170d350a084d91d8dc4--
