Nmap

Nmap is a widely-used open-source network scanner for discovering hosts, services, and security risks on computer networks.

Nmap is a leading open-source network scanning tool used for network discovery and security auditing. This connector enables Swimlane Turbine users to automate host availability checks and detailed port scans directly within their security workflows, without writing code. By integrating Nmap, security teams can quickly assess network status, identify open or vulnerable ports, and gather actionable network intelligence. This streamlines incident response, enhances visibility into network assets, and reduces manual effort in routine network assessments.

This connector performs network scans and gather information about hosts on a network.

Capabilities

Actions allow to pass arguments to Nmap. The following table lists the available arguments and their description. Note that arguments are case-sensitive and it is allowed to combine multiple arguments in a single action. Nmap arguments:

Scan Type: This argument specifies the type of scan to be performed. Nmap offers various types of scans such as TCP, UDP, SYN, FIN, Xmas, NULL, and others. For example, -sS will perform a SYN scan.

Service and Version Detection: This argument attempts to detect the type of service running on a given port and the version of the service. For example, -sV will attempt to identify the service and version running on open ports.

Operating System Detection: This argument attempts to identify the operating system running on the scanned hosts. For example, -O will attempt to identify the operating system.

Timing and Performance: This argument allows users to adjust the timing and performance of the scan. For example, nmap -T4 will set the timing template to aggressive scan.

Firewall/IDS Evasion and Spoofing: This argument allows users to bypass firewall and IDS detection mechanisms by spoofing packets. For example, -S spoofed_ip will send packets with a spoofed IP address.

Scripting: This argument allows users to use custom scripts to automate the scanning process or perform advanced tasks. For example, --script smb-os-discovery.nse will use the SMB OS Discovery script.

Aggressive Scanning: This argument enables aggressive scanning, which can speed up the scanning process and detect more hosts and services. For example, -A will enable aggressive scanning.

Ping Options: This argument allows users to configure the ping options used by Nmap. For example, -Pn will disable ping scanning, while -PE will use ICMP echo requests for ping scanning.

Timing Template: This argument allows users to set the timing template used by Nmap for scanning. For example, -T4 will set the timing template to aggressive scan.

Traceroute: This argument performs a traceroute to the scanned hosts. For example, --traceroute will perform a traceroute.

IPv6 Scanning: This argument enables IPv6 scanning. For example, -6 will enable IPv6 scanning.

DNS Resolution: This argument performs DNS resolution of hostnames to IP addresses. For example, -R will perform DNS resolution.

Firewall Detection: This argument detects whether a firewall is present and active on the scanned hosts. For example, -sA will perform an ACK scan to detect firewalls.

OS Detection: This argument attempts to detect the operating system running on the scanned hosts. For example, -O will attempt to identify the operating system.

Scripting Engine: This argument allows users to run scripts to automate or customize the scanning process. For example, --script=default will run the default Nmap scripts.

Exclude Hosts: This argument excludes specified hosts from the scan. For example, --exclude 192.168.1.10 will exclude the host with IP address 192.168.1.10 from the scan.

Actions

Check Network Status

Check the status of specified hosts using Nmap and retrieve information about their availability and network connectivity.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
args	string	Optional	Arguments to pass to nmap. Defaults to '-n -sP -PE -PA21,23,80,3389'
host	string	Required	Host to scan
timeout	number	Optional	Timeout in seconds. Defaults to 0 (infinite)
raw_data	boolean	Optional	Return raw data

Input Example

{"host":"swimlane.com","timeout":0,"raw_data":true}

Output

Parameter	Type	Description
info	array	Output field: info
info.ip	string	Output field: info.ip
info.hostname	string	Name of the resource
info.status	string	Status value
info.mac	string	Output field: info.mac
raw_data	string	Response data

Output Example

{"info":[{"ip":"104.26.2.130","hostname":"swimlane.com","status":"up","mac":"62:26:ba:0d:f2:9e"}],"raw_data":"b'<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<!DOCTYPE nmaprun>\\n<?xml-stylesheet h..."}

Scan Ports

Scan specified host to identify open, closed, or filtered ports and retrieve detailed port status information using Nmap.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
host	string	Required	Host(s) to scan. Examples 'scanme.nmap.org' or '198.116.0-255.1-127' or '216.163.128.20/20'
ports	string	Optional	Port(s) to scan. Examples '22,53,110,143-4564'. Default is all ports.
args	string	Optional	Additional arguments to pass to nmap. Examples '-sU -sX -sC'. Defaults to '-sV'
sudo	boolean	Optional	Run nmap with sudo
timeout	number	Optional	Timeout in seconds. Defaults to 0 which is infinite.
raw_data	boolean	Optional	Return raw data from nmap. Defaults to false.

Input Example

{"host":"swimlane.com","ports":"22,53,110,150-200","args":"-sV","sudo":false,"timeout":0,"raw_data":true}

Output

Parameter	Type	Description
hosts	array	Output field: hosts
info	array	Output field: info
info.ip	string	Output field: info.ip
info.host_info	object	Output field: info.host_info
info.host_info.command_line_run	string	Output field: info.host_info.command_line_run
info.host_info.scan_info	object	Output field: info.host_info.scan_info
info.host_info.scan_info.tcp	object	Output field: info.host_info.scan_info.tcp
info.host_info.scan_info.tcp.method	string	HTTP method to use
info.host_info.scan_info.tcp.services	string	Output field: info.host_info.scan_info.tcp.services
info.host_info.scan_stats	object	Output field: info.host_info.scan_stats
info.host_info.scan_stats.timestr	string	Output field: info.host_info.scan_stats.timestr
info.host_info.scan_stats.elapsed	string	Output field: info.host_info.scan_stats.elapsed
info.host_info.scan_stats.uphosts	string	Output field: info.host_info.scan_stats.uphosts
info.host_info.scan_stats.downhosts	string	Output field: info.host_info.scan_stats.downhosts
info.host_info.scan_stats.totalhosts	string	Output field: info.host_info.scan_stats.totalhosts
info.host_info.host	object	Output field: info.host_info.host
info.host_info.host.hostname	string	Name of the resource
info.host_info.host.status	string	Status value
info.host_info.host.addresses	object	Output field: info.host_info.host.addresses
info.host_info.host.addresses.ipv4	string	Output field: info.host_info.host.addresses.ipv4
info.host_info.host.addresses.ipv6	string	Output field: info.host_info.host.addresses.ipv6
info.host_info.host.addresses.mac	string	Output field: info.host_info.host.addresses.mac
info.host_info.host.vendor	object	Output field: info.host_info.host.vendor
info.host_info.host.open_ports	array	Output field: info.host_info.host.open_ports
info.host_info.host.open_ports.protocol	string	Output field: info.host_info.host.open_ports.protocol

Output Example

{"hosts":["172.67.74.8"],"info":[{"ip":"172.67.74.8","host_info":{}}],"raw_data":"b'<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<!DOCTYPE nmaprun>\\n<?xml-stylesheet h..."}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT