🛡️ **BREAKING: Internal lateral movement detected on nova-core — 192.168.1.86 probing 192.168.1.138**
Published Friday, July 24, 2026 at 10:19 PM PT BLUF: IPS detected a lateral scan from 192.168.1.86 attempting connections to 5 ports on 192.168.1.138 (nova-core subnet) over 60 seconds. Source and intent are unconfirmed; immediate identification of both endpoints and network isolation assessment required. DETAILS Event: Port probe targeting nova-core (192.168.1.138) from internal source 192.168.1.86; 5 distinct ports scanned in 60-second window. Scope: Internal network only (no external routing observed in alert). Status: Lateral movement detected (reconnaissance phase); no confirmation yet of successful connection, shell access, or data movement. Source endpoint unknown: 192.168.1.86 identity not provided in alert; could be user workstation, IoT device, compromised endpoint, or misconfigured service. Requires immediate ARP/DHCP lookup. Target endpoint: nova-core infrastructure. Which specific nova-core services/ports are unclear from alert metadata alone. IMPACT ...