# smartinst\_scan\_external\_internal

**Explanation**

This NDM is designed to detect Cisco SmartInstall scanning that is hitting the customer’s network from the Internet. Cisco SmartInstall is a configuration and image-management feature for switches.

**What to Look For**

Scanning activity on the Internet is quite commonplace. Under normal circumstances, Cisco SmartInstall should not be exposed to the open Internet.

**Related MITRE ATT\&CK Categories**

[Reconnaissance: Active Scanning, Technique T1595 - Enterprise](https://attack.mitre.org/techniques/T1595)