T1595.001
Scanning IP Blocks
Out of scope
This technique happens before any contact with a monitored environment, so no range can observe it. It is indexed here for reference and will not receive a write-up. Why Reconnaissance is out of scope
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- Network flow records (Zeek conn, NetFlow, firewall flow) (the log as a whole)