# Detect Portscans

**URL:** <https://forum.opensearch.org/t/detect-portscans/11428>\
**Category:** OpenSearch\
**Created:** [November 7, 2022, 10:01am UTC](https://forum.opensearch.org/t/detect-portscans/11428 "2022-11-07T10:01:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mschneiderEvo](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@mschneiderEvo](https://forum.opensearch.org/u/mschneiderEvo)\
**Post date:** [November 7, 2022, 10:01am UTC](https://forum.opensearch.org/t/detect-portscans/11428/1 "2022-11-07T10:01:09Z")

</div>

**Versions** Opensearch 2.0.0

**Describe the issue** : Searching for a way to detect Portscans, It seems that Anomaly Detection Jobs don’t really work well for this kind of task.

We are using Winlogbeat and Netflow to get Logs, but we can’t figure out how we can detect a Port scan with the tools provided by Opensearch.

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [November 18, 2022, 6:43pm UTC](https://forum.opensearch.org/t/detect-portscans/11428/2 "2022-11-18T18:43:43Z")

</div>

Hello @mschneiderEvo - welcome to the OpenSearch community.

what kind of pattern/spikes in the logs are looking to catch the event? (one of our developers asked)