neo4j_scan_external_internal

Explanation

This NDM is designed to detect scanning for Neo4j (port 7474) that is hitting the customer’s network from the Internet. Neo4j is a graph database.

What to Look For

Scanning activity on the Internet is quite commonplace. Neo4j should not be exposed to the open Internet.

Related MITRE ATT&CK Categories

Reconnaissance: Active Scanning, Technique T1595 - Enterprise