Update discovery_potential_port_scan_detected.toml

w0rk3r · w0rk3r · commit 5f0509fa0106 · 2025-12-18T13:03:17.000-03:00
diff --git a/rules/network/discovery_potential_port_scan_detected.toml b/rules/network/discovery_potential_port_scan_detected.toml
@@ -17,6 +17,7 @@ connection attempts from a single internal source to a wide range of destination
 from = "now-9m"
 language = "esql"
 license = "Elastic License v2"
+max_signals = 5
 name = "Potential Network Scan Detected"
 risk_score = 21
 rule_id = "0171f283-ade7-4f87-9521-ac346c68cc9b"
