$ALERT=PORTSCAN
$LANG=en
$CHARSET=UTF-8
$DESC=Formatted HTML (English)

#Template for portscan alert

[TEMPLATE]
<html>
<body font-family="verdana, tahoma, sans-serif" font-size="80%" align="left" bgcolor="#FFFFFF" text="#989898">
 <font color="#FF6810"><h1>Portscan detected</h1></font>
 <table bgcolor="#E8E4F8" text="#7880A8">
  <tr><th colspan="2" bgcolor="#B8B8F0" align="center"><font color="#FFF">Event description</font></th></tr>
  <tr><td><font color="#7880A8"><b>Host (IP):</b></font></td><td><font color="#7880A8">$HOSTNAME$ ($HOSTIP$)</font></td></tr>
  <tr><td><font color="#7880A8"><b>Details:</b></font></td><td><font color="#7880A8">$LOG$</font></td></tr>
 </table>
<br><br>
<h3>Alert description</h3>

<p>
A portscan is an attempt by an attacker to enumerate the services running on a machine by probing each port for a response. This is an attempt by an intruder to determine how best to attack a system. By determining which services are running on a host, an intruder can direct an attack more effectively, reducing the amount of time and effort required to gain unauthorized access.
<br>
There are many legitimate applications (e.g., FTP) that can appear to be a portscan. Therefore, you should investigate the initial events to determine whether they were legitimate or not.
</p>
</body></html>
