{
  "port": 3995,
  "protocol": "tcp",
  "service": "ISS management services SSL",
  "oneLiner": "The TLS management channel that ISS security appliances and sensors use to report to a SiteProtector console.",
  "whatItIs": "IANA registers 3995 as iss-mgmt-ssl, \"ISS Management Svcs SSL\". Internet Security Systems built RealSecure sensors and the SiteProtector management console; IBM acquired ISS and carried the architecture into the Proventia line. IBM's Proventia documentation gives 3995 as the default port for alerts sent to the SiteProtector system, and notes that the appliance trusts connections arriving on it. On a scan it marks an intrusion-detection or -prevention deployment of that generation.",
  "exposure": {
    "verdict": "never",
    "note": "The vendor's own documentation says the appliance trusts connections on this port — a security management plane that trusts its peers must be reachable only from those peers, on an isolated network."
  },
  "checkCommand": "openssl s_client -connect TARGET:3995 -brief </dev/null",
  "links": [
    {
      "title": "IBM Proventia Network MFS administrator guide (SiteProtector alerts default to 3995)",
      "url": "https://public.dhe.ibm.com/software/security/products/infrastructure_protection/ProvNetworkMFS/Versions_3.13_and_3.14/Proventia_Network_MFS_AdministratorGuide313.pdf",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 3995 (iss-mgmt-ssl)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3995",
      "kind": "iana"
    }
  ],
  "ianaName": "iss-mgmt-ssl"
}