Port scan detected from internal host

The firewall saw one computer inside our network try more than 100 different ports in under a minute. A port is a numbered door where a service listens. This looks like a port scan, which attackers use to find weak spots. Our own security team scans too.

Your task: Decide if this is an attack or planned work. Find out whose computer it is and whether a scan was booked.