diff --git a/Nmap/200400-nmap-scan_rules.xml b/Nmap/200400-nmap-scan_rules.xml
new file mode 100644
index 0000000..a2d666f
--- /dev/null
+++ b/Nmap/200400-nmap-scan_rules.xml
@@ -0,0 +1,9 @@
+<group name="linux,nmap,network_scan">
+    <rule id="200400" level="3">
+        <decoded_as>json</decoded_as>
+        <field name="nmap_host">\.+</field>
+        <field name="nmap_protocol">\.+</field>
+        <description>NMAP: Network Scan Host $(nmap_host)</description>
+        <options>no_full_log</options>
+    </rule>
+</group>