# ping\_scan\_int-ext **Explanation** ping\_scan\_int-ext is a security event in the Netography Fusion Portal that looks for Internal to External Ping Scans. **What to Look For** If ping\_scan\_int-ext is triggered, it means that an internal host within your network is attempting to ping external IP addresses. This is a potential sign of an attacker attempting to map out your network and identify potential targets for further exploitation. Look for abnormal ping activity from internal hosts and investigate any suspicious traffic from those hosts. It may also be indicative of an infection, or a misconfiguration in a network scanning or mapping tool. **Related MITRE ATT\&CK Categories** [Discovery: Network Service Discovery, Technique T1046 - Enterprise](https://attack.mitre.org/techniques/T1046) [Reconnaissance: Active Scanning, Technique T1595 - Enterprise](https://attack.mitre.org/techniques/T1595) --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.fusion.vectra.ai/detection-models/library/reconnaissance/ping_scan_int-ext.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.