event EventHandler<HoneyPotDetectionEventArgs> OnPortAccessDetected
Event Data
The event handler receives an argument of type HoneyPotDetectionEventArgs containing data related to this event. The following HoneyPotDetectionEventArgs properties provide information specific to this event.
Property | Description |
---|---|
Answer | If value is set the socket will answer the text assigned |
CloseConnection | Will terminate the connection, set to false if you like to "keep the conversation going" for legal proposes |
CreateIncident | Set the value to True if you would like to generate an incident |
Data | The data collected during the detection |
GuardResponse | Gets the guard response. |
PortAlias | The port alias that detected the communication |
SendPayload | This will let the service send the file and a command to the attacker |
Remarks
This event is raised whenever there is an attempt to access a monitored port, enabling the implementation of custom logic for handling such incidents.
Example
using Microsoft.Extensions.DependencyInjection; using System; public class Example { public static void Main() { // Configure services var serviceProvider = new ServiceCollection() .UsePortScannerProtection(option => { option.Echo = 7; option.IgnoreAfterDetection = IgnoreScope.IPAddressAndPort; }) .BuildServiceProvider(); // Retrieve the port scanner detection service var portScannerService = serviceProvider.GetRequiredService<IPortScannerDetectionService>(); // Subscribe to the OnPortAccessDetected event portScannerService.OnPortAccessDetected += (sender, e) => { PortAliasMapper mapped= e.PortAlias; IHoneyPotPortDetection data = e.Data; ... }; // Start the service portScannerService.Start(); // Additional logic here } }
Requirements
Target Platforms: Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows Server 2008 (Server Core not supported), Windows Server 2008 R2 (Server Core supported with SP1 or later), Windows Server 2003 SP2
See Also