Detection Rules Triggered although ports are closed!


In SEIM, I can see some detection rules are triggered like although the related ports are already closed: "Telnet Port Activity" (which works on port 23)

and "SMTP on Port 26/TCP" (which works on port 26)

I tried to netcat them and they are triggered again although they are closed!

1- Why the rules are triggered although ports are closed?
2- how can I disable alerting on closed ports and keep it for open ones only?

Thanks in advance.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.