Threat Hunting With Python Part 2: Detecting Nmap Behavior with Bro HTTP Logs

This post demonstrates how to detect Nmap network scans by analyzing HTTP behavior rather than relying solely on hard-coded URIs. Using a 2015 conference pcap and Bro (Zeek) http.log, it highlights useful indicators such as atypical or missing user-agent strings (including the Nmap Scripting Engine UA), spikes in non-200 HTTP status codes (404s, other errors, and “-” no-status entries), and temporal clustering of requests. The author recommends building an inventory of HTTP client/host behaviors in OT environments, mapping normal status-code/access patterns, and performing regular hunts across multiple log sources to reliably identify reconnaissance activity.