port_activity
Pack: isc-sans · Endpoint: https://gateway.pipeworx.io/isc-sans/mcp
Get recent attack/probe activity for a TCP/UDP port from SANS ISC — daily counts of report records, distinct target IPs, and distinct source IPs hitting the port. Useful for spotting scanning surges against services like SSH (22), RDP (3389), SMB (445), or Telnet (23). Keyless.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
port | number | yes | A port number, e.g. 22 (SSH), 3389 (RDP), 445 (SMB), 23 (Telnet). |
Example call
curl -X POST https://gateway.pipeworx.io/isc-sans/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"port_activity","arguments":{}}}'Connect
Add this to your MCP client config, or use one-click install buttons:
{
"mcpServers": {
"isc-sans": {
"url": "https://gateway.pipeworx.io/isc-sans/mcp"
}
}
}See Getting Started for client-specific install steps.