You will need logs from somewhere that show those scans - either from the machines where the scans originate, or something that captures this on the network, e.g. a firewall this passes through, a router that logs this passing through its Access Control Lists etc.

Once you HAVE those logs, alerting and analysing on this activity is quite simple in Logpoint.

Hi @Nils Krumey ,

Thank you so much for your help.

Best regards,

Siawash

Hello , 

How can we query the SIEM for this information ?

thank you