The remote host is utilizing Nmap, an open-source network scanner capable of discovering listening services or open ports on remote systems.

The remote host is running Air Video server. Air Video is a software application for Apple OS X which allows multimedia streaming across a number of devices.

The remote host is passing traffic over 500/UDP

The remote host was observed making DNS queries to one or more Google public DNS servers. Utilizing Google's public DNS service may allow users to bypass web filtering or circumvent other security measures. Malicious actors may also use these servers in an attempt to discretely reach out to internet resources while remaining undetected.

 Google Public DNS Addresses :
  - 8.8.8.8
  - 8.8.4.4

The remote host was observed making DNS queries to a Google public DNS server.

The remote DNS client has experienced a surge in activity.

The remote host is a DNS client utilizing TCP. This can be an indicator of malicious activity.

The remote host has sent a large DNS response which contained a TEXT record. Note: TEXT records are a normal DNS request but larger messages should be inspected for possibly malicious traffic.

The remote host has sent data over port 53 which does not seem to be valid DNS traffic.

Tor2web is a software project that allows Tor hidden services to be accessed from a standard browser without being connected to the Tor network. In the past, various malware campaigns and botnets have utilized Tor2Web to exfiltrate data or communicate externally. Recent traffic from this host indicates it has accessed a Tor URL through a known Tor2Web proxy.

The remote host has sent data over port 123 which does not seem to be valid NTP traffic.

The remote host has just made a connection to the i2p network. The i2p network allows users to tunnel traffic anonymously and encrypted to untrackable servers.

The remote host is running Tor Browser.  Tor Browser has successfully connected to a Tor node.   

The remote client was observed connecting to a Virtual Private Network (VPN) through an HTTP proxy. The client is configured to use an HTTP proxy to tunnel the VPN connection to an external network. This type of connection allows a local user to connect to a remote network as if they were local users.  A VPN that allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of risk to the internal computing environment. 

The remote server was just observed making a connection to updates.metasploit.com.  This connection attempt usually indicates a Metasploit server that is downloading updates from the metasploit.com web site.  Metasploit is an attack framework that allows users to automatically exploit and backdoor vulnerable applications via the network. 

The remote host has an application installed (such as Superfish) that uses the Komodia SSL Digestor SDK. This SDK is used to perform MitM attacks on all HTTPS connections. This is accomplished by installing a root CA certificate associated with the SDK into the Windows trusted system certificate store. The private keys for many of these root CAs are publicly known. Furthermore, this SDK is insecurely implemented and will report websites that use specially crafted self-signed certificates as trusted to the user.

A MitM attacker can exploit this vulnerability by reading and/or modifying communications encrypted via HTTPS without the user's knowledge.

The remote host is running the Google Gbridge client.  Gbridge is a VPN application which allows a user to chat, share files, share desktops, and more with peers over a VPN connection.

The remote host is configured with the TLS heartbeat message feature and appears to be affected by an out-of-bounds read flaw.  This flaw could allow a remote attacker to read the contents of up to 64KB of server memory, potentially exposing passwords, private keys, and other sensitive data.

The remote host is running the Microsoft Xbox gaming console

The remote host is running the Sony PlayStation 4 gaming platform.

The remote service is a PC-Link client, used for streaming videos, music, and pictures to a KiSS player, and this port is used by a player when searching for a PC-Link server. 

The remote host is running the Microsoft Xbox gaming console version :

The remote host is running non-FTP traffic over port 21.  Port 21 is a port that is typically allowed outbound access via a firewall.  Because of this, some users may attempt to pass non-FTP traffic over port 21.  

The remote host is running non-SSH traffic over port 22.  Port 22 is a port that is typically allowed outbound access via a firewall.  Because of this, some users may attempt to pass non-SSH traffic over port 22.  

The remote host is running non-FTP traffic over port 21.

The remote host is running non-SSH traffic over port 22.

The remote host is running non-SSL traffic over port 443.  Port 443 is a port that is typically allowed outbound access via a firewall.  Because of this, some users may attempt to pass non-SSL traffic over port 443.  

The remote host is running non-SSL traffic over port 443.

The remote host has software and services running that have been detected via SNMP.

The remote client is running a Financial Information eXchange (FIX) application.  This protocol is used by financial institutions to exchange data.  The FIX protocol has very few built-in security controls and, instead, relies on industry standard encryption (PGP, SSL/TLS, etc.) to protect the stream.  The NNM has just observed this client initiate a LOGON request utilizing the PGP protocol.

The remote client is running a Financial Information eXchange (FIX) application.  This protocol is used by financial institutions to exchange data.  The FIX protocol has very few built-in security controls and, instead, relies on industry standard encryption (PGP, SSL/TLS, etc.) to protect the stream.  The NNM has just observed this client initiate a LOGON request without encryption set.

The remote server is running a Financial Information eXchange (FIX) application.  This protocol is used by financial institutions to exchange data.  The FIX protocol has very few built-in security controls and, instead, relies on industry standard encryption (PGP, SSL/TLS, etc.) to protect the stream.  The NNM has noted a client initiating a LOGON to this server without use of the 'encryption' key.

The remote server is running a Financial Information eXchange (FIX) application.  This protocol is used by financial institutions to exchange data.  The FIX protocol has very few built-in security controls and, instead, relies on industry standard encryption (PGP, SSL/TLS, etc.) to protect the stream.

The remote client is running a Financial Information eXchange (FIX) application.  This protocol is used by financial institutions to exchange data.  The FIX protocol has very few built-in security controls and, instead, relies on industry standard encryption (PGP, SSL/TLS, etc.) to protect the stream.

The remote host was observed initiating an FTP connection to an FTP server on a non-standard port.

The remote host sent an email with the following attachment

PVS has detected the remote host downloading a package from a Red Hat Satellite server.

PVS has detected a Red Hat Satellite software channel to which the remote host is subscribed.

PVS has detected a Red Hat Satellite server attempt to install a package on the remote host.

PVS has detected a Red Hat Satellite server attempt to remove a package from the remote host.

PVS has detected a new system register to a Red Hat Satellite server.

PVS has observed data from a Red Hat Satellite client.

The remote host is utilizing an Instagram application to upload a photo. Instagram is a free photo-sharing application for mobile devices that can publish photos on Facebook, Twitter, and Tumblr, as well as its native application interface.

ID	Name	Severity
9056	Nmap Scanner Detection	info
9808	Air Video Server Detection	info
9368	ISAKMP Trigger	info
9367	ISAKMP Trigger	info
8996	Google Public DNS Usage Detection	info
8995	Google Secondary Public DNS Detection	info
8994	Google Primary Public DNS Detection	info
7175	DNS Statistical Surge	info
7174	DNS TCP Connection Detection	info
7173	DNS TEXT Type Record Detection	info
7172	Non-DNS Traffic Over Port 53	info
8819	Tor2Web Onion DNS Query Detection	info
8818	Tor2Web DNS Query Detection	info
7177	Tor2Web Access Detection	medium
7176	Non-NTP Traffic Over Port 123	info
7170	I2P Outbound Connection Detection	info
7167	Tor Browser Detection	info
3177	VPN Tunnel Detection via HTTP CONNECT	info
3806	Metasploit Server Detection	info
8930	Komodia SSL Digestor SDK MitM (Detected via HTTP Request)	medium
8929	Komodia SSL Digestor SDK MitM (Detected via DNS Query)	medium
8239	Gbridge Client Detection	info
7108	OpenSSL Heartbeat Information Disclosure (Heartbleed)	high
8094	Xbox Gaming Console Detection	info
8093	Xbox Gaming Console Detection	info
8090	Sony PlayStation 4 Detection	info
8080	KiSS PC-Link Client Detection	info
8079	Xbox Gaming Console Detection	info
8078	Port 21 Non-FTP Traffic Detection	info
8077	Port 22 Non-SSH Traffic Detection	info
7087	Non-FTP Traffic Over Port 21	info
7086	Non-SSH Traffic Over Port 22	info
8076	Port 21 Non-FTP Traffic Detection	info
8074	Port 443 Non-SSL Traffic Detection (deprecated)	info
7085	Non-SSL Traffic Over Port 443 (deprecated)	info
7081	SNMP Services Detection	info
6741	FIX client PGP LOGON detection	info
6740	FIX client LOGON detection	info
6739	FIX Server LOGON detection	info
6738	FIX Server Detection	info
6737	FIX client detection	info
7078	FTP Client Connection on Non-Standard Port Detection	info
6682	Email Attachment Detection (client)	info
7073	Red Hat Satellite Package Download Detection	info
7072	Red Hat Satellite Software Channel Detection	info
7071	Red Hat Satellite Package Installation Detection	info
7070	Red Hat Satellite Package Removal Detection	info
7069	Red Hat Satellite New System Registration Detection	info
7068	Red Hat Satellite Data Detection (deprecated)	info
6651	Instagram Upload Activity Detected	info

Detections

Analytics

Policy Family for Nessus Network Monitor

info

info

info

info

info

info

info

info

info

info

info

info

info

medium

info

info

info

info

info

medium

medium

info

high

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info