What it detects
Hits on recon scanner, admin brute, bot UA, 4xx flood, JA3 diversity and TCP short-scan rules.
Why it fires
Automated attack or recon activity caught by explicit rules.
Worst case
Automated attack · recon
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.