I've recently become obsessed with detecting SYN scans on our network. I realized the scan only alerts when I touch the firewall as it acts as the vlan gateway. With all of the endpoint detection mechanisms we leverage, none of them appear to give a damn about port scanning.
So far I've created a quick and dirty config do basically only alert on port scans. It only logs the alert and as far as I can tell doesn't consume any resources and does exactly what I want it to do. So my proof of concept is showing value. My manager is always on board with trying something new so I don't think I would get any pushback with this project. My only concern is getting it into production and deployment.
Have any of you had experience with deploying Snort as endpoint detection? How do you maintain it? Any special deployment scripts you could share, with redacted information, of course?