IDH portscan not detecting port scans

[kspringer-maf]

Version

2.4.141

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

many

RAM

much

Storage for /

lots

Storage for /nsm

lots

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I recently added the IDH HoneyPot node to my grid. I enabled all the extra opencanary options in the configs, and it works and I get event alerts when hitting each port directly. But I don't get anything when running general port scans from nmap or AngryIP. I've tried adjusting the 'portscan' config settings, but that didn't affect anything. It's as if the ports can be scanned successfully without the IDH caring. This seems counter-intuitive to the point of a HoneyPot. Please advise.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.