From cdafa9268fa49473cfd236777497cfb9215ad02e Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Tue, 2 Dec 2025 09:21:16 +0100 Subject: [PATCH] [Rule Tunings] Misc. Web Server Rules (#5384) (cherry picked from commit e19ce18a4092ee4c4145ac6169f13a4f4504f0be) --- ...eb_server_potential_command_injection.toml | 40 +++++----- ..._server_discovery_or_fuzzing_activity.toml | 20 ++--- ...eb_server_unusual_spike_in_error_logs.toml | 4 +- ...unusual_spike_in_error_response_codes.toml | 17 ++--- ...ssance_web_server_unusual_user_agents.toml | 74 +++++++++---------- 5 files changed, 68 insertions(+), 87 deletions(-) diff --git a/rules/cross-platform/persistence_web_server_potential_command_injection.toml b/rules/cross-platform/persistence_web_server_potential_command_injection.toml index 48af11e6f..48f009177 100644 --- a/rules/cross-platform/persistence_web_server_potential_command_injection.toml +++ b/rules/cross-platform/persistence_web_server_potential_command_injection.toml @@ -1,8 +1,8 @@ [metadata] creation_date = "2025/11/19" -integration = ["nginx", "apache", "apache_tomcat", "iis", "network_traffic"] +integration = ["nginx", "apache", "apache_tomcat", "iis"] maturity = "production" -updated_date = "2025/11/24" +updated_date = "2025/12/01" [rule] author = ["Elastic"] @@ -54,14 +54,12 @@ rule_id = "f3ac6734-7e52-4a0d-90b7-6847bf4308f2" severity = "low" tags = [ "Domain: Web", - "Domain: Network", "Use Case: Threat Detection", "Tactic: Reconnaissance", "Tactic: Persistence", "Tactic: Execution", "Tactic: Credential Access", "Tactic: Command and Control", - "Data Source: Network Packet Capture", "Data Source: Nginx", "Data Source: Apache", "Data Source: Apache Tomcat", @@ -71,26 +69,24 @@ tags = [ timestamp_override = "event.ingested" type = "esql" query = ''' -from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-* +from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-* | where - (url.original is not null or url.full is not null) and // Limit to 200 response code to reduce noise http.response.status_code == 200 -| eval Esql.url_lower = case(url.original is not null, url.original, url.full) -| eval Esql.url_lower = to_lower(Esql.url_lower) +| eval Esql.url_original_to_lower = to_lower(url.original) -| eval Esql.contains_interpreter = case(Esql.url_lower like "*python* -c*" or Esql.url_lower like "*perl* -e*" or Esql.url_lower like "*ruby* -e*" or Esql.url_lower like "*ruby* -rsocket*" or Esql.url_lower like "*lua* -e*" or Esql.url_lower like "*php* -r*" or Esql.url_lower like "*node* -e*", 1, 0) -| eval Esql.contains_shell = case(Esql.url_lower like "*/bin/bash*" or Esql.url_lower like "*bash*-c*" or Esql.url_lower like "*/bin/sh*" or Esql.url_lower rlike "*sh.{1,2}-c*", 1, 0) -| eval Esql.contains_nc = case(Esql.url_lower like "*netcat*" or Esql.url_lower like "*ncat*" or Esql.url_lower rlike """.*nc.{1,2}[0-9]{1,3}(\.[0-9]{1,3}){3}.{1,2}[0-9]{1,5}.*""" or Esql.url_lower like "*nc.openbsd*" or Esql.url_lower like "*nc.traditional*" or Esql.url_lower like "*socat*", 1, 0) -| eval Esql.contains_devtcp = case(Esql.url_lower like "*/dev/tcp/*" or Esql.url_lower like "*/dev/udp/*", 1, 0) -| eval Esql.contains_helpers = case((Esql.url_lower like "*/bin/*" or Esql.url_lower like "*/usr/bin/*") and (Esql.url_lower like "*mkfifo*" or Esql.url_lower like "*nohup*" or Esql.url_lower like "*setsid*" or Esql.url_lower like "*busybox*"), 1, 0) -| eval Esql.contains_sus_cli = case(Esql.url_lower like "*import*pty*spawn*" or Esql.url_lower like "*import*subprocess*call*" or Esql.url_lower like "*tcpsocket.new*" or Esql.url_lower like "*tcpsocket.open*" or Esql.url_lower like "*io.popen*" or Esql.url_lower like "*os.execute*" or Esql.url_lower like "*fsockopen*", 1, 0) -| eval Esql.contains_privileges = case(Esql.url_lower like "*chmod*+x", 1, 0) -| eval Esql.contains_downloader = case(Esql.url_lower like "*curl *" or Esql.url_lower like "*wget *" , 1, 0) -| eval Esql.contains_file_read_keywords = case(Esql.url_lower like "*/etc/shadow*" or Esql.url_lower like "*/etc/passwd*" or Esql.url_lower like "*/root/.ssh/*" or Esql.url_lower like "*/home/*/.ssh/*" or Esql.url_lower like "*~/.ssh/*" or Esql.url_lower like "*/proc/self/environ*", 1, 0) -| eval Esql.contains_base64_cmd = case(Esql.url_lower like "*base64*-d*" or Esql.url_lower like "*echo*|*base64*", 1, 0) -| eval Esql.contains_suspicious_path = case(Esql.url_lower like "*/tmp/*" or Esql.url_lower like "*/var/tmp/*" or Esql.url_lower like "*/dev/shm/*" or Esql.url_lower like "*/root/*" or Esql.url_lower like "*/home/*/*" or Esql.url_lower like "*/var/www/*" or Esql.url_lower like "*/etc/cron.*/*", 1, 0) +| eval Esql.contains_interpreter = case(Esql.url_original_to_lower like "*python* -c*" or Esql.url_original_to_lower like "*perl* -e*" or Esql.url_original_to_lower like "*ruby* -e*" or Esql.url_original_to_lower like "*ruby* -rsocket*" or Esql.url_original_to_lower like "*lua* -e*" or Esql.url_original_to_lower like "*php* -r*" or Esql.url_original_to_lower like "*node* -e*", 1, 0) +| eval Esql.contains_shell = case(Esql.url_original_to_lower like "*/bin/bash*" or Esql.url_original_to_lower like "*bash*-c*" or Esql.url_original_to_lower like "*/bin/sh*" or Esql.url_original_to_lower rlike "*sh.{1,2}-c*", 1, 0) +| eval Esql.contains_nc = case(Esql.url_original_to_lower like "*netcat*" or Esql.url_original_to_lower like "*ncat*" or Esql.url_original_to_lower rlike """.*nc.{1,2}[0-9]{1,3}(\.[0-9]{1,3}){3}.{1,2}[0-9]{1,5}.*""" or Esql.url_original_to_lower like "*nc.openbsd*" or Esql.url_original_to_lower like "*nc.traditional*" or Esql.url_original_to_lower like "*socat*", 1, 0) +| eval Esql.contains_devtcp = case(Esql.url_original_to_lower like "*/dev/tcp/*" or Esql.url_original_to_lower like "*/dev/udp/*", 1, 0) +| eval Esql.contains_helpers = case((Esql.url_original_to_lower like "*/bin/*" or Esql.url_original_to_lower like "*/usr/bin/*") and (Esql.url_original_to_lower like "*mkfifo*" or Esql.url_original_to_lower like "*nohup*" or Esql.url_original_to_lower like "*setsid*" or Esql.url_original_to_lower like "*busybox*"), 1, 0) +| eval Esql.contains_sus_cli = case(Esql.url_original_to_lower like "*import*pty*spawn*" or Esql.url_original_to_lower like "*import*subprocess*call*" or Esql.url_original_to_lower like "*tcpsocket.new*" or Esql.url_original_to_lower like "*tcpsocket.open*" or Esql.url_original_to_lower like "*io.popen*" or Esql.url_original_to_lower like "*os.execute*" or Esql.url_original_to_lower like "*fsockopen*", 1, 0) +| eval Esql.contains_privileges = case(Esql.url_original_to_lower like "*chmod*+x", 1, 0) +| eval Esql.contains_downloader = case(Esql.url_original_to_lower like "*curl *" or Esql.url_original_to_lower like "*wget *" , 1, 0) +| eval Esql.contains_file_read_keywords = case(Esql.url_original_to_lower like "*/etc/shadow*" or Esql.url_original_to_lower like "*/etc/passwd*" or Esql.url_original_to_lower like "*/root/.ssh/*" or Esql.url_original_to_lower like "*/home/*/.ssh/*" or Esql.url_original_to_lower like "*~/.ssh/*" or Esql.url_original_to_lower like "*/proc/self/environ*", 1, 0) +| eval Esql.contains_base64_cmd = case(Esql.url_original_to_lower like "*base64*-d*" or Esql.url_original_to_lower like "*echo*|*base64*", 1, 0) +| eval Esql.contains_suspicious_path = case(Esql.url_original_to_lower like "*/tmp/*" or Esql.url_original_to_lower like "*/var/tmp/*" or Esql.url_original_to_lower like "*/dev/shm/*" or Esql.url_original_to_lower like "*/root/*" or Esql.url_original_to_lower like "*/home/*/*" or Esql.url_original_to_lower like "*/var/www/*" or Esql.url_original_to_lower like "*/etc/cron.*/*", 1, 0) | eval Esql.any_payload_keyword = case( Esql.contains_interpreter == 1 or Esql.contains_shell == 1 or Esql.contains_nc == 1 or Esql.contains_devtcp == 1 or @@ -99,7 +95,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access- | keep @timestamp, - Esql.url_lower, + Esql.url_original_to_lower, Esql.any_payload_keyword, Esql.contains_interpreter, Esql.contains_shell, @@ -123,13 +119,13 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access- | stats Esql.event_count = count(), - Esql.url_path_count_distinct = count_distinct(Esql.url_lower), + Esql.url_path_count_distinct = count_distinct(Esql.url_original_to_lower), // General fields Esql.host_name_values = values(host.name), Esql.agent_id_values = values(agent.id), - Esql.url_path_values = values(Esql.url_lower), + Esql.url_path_values = values(Esql.url_original_to_lower), Esql.http.response.status_code_values = values(http.response.status_code), Esql.user_agent_original_values = values(user_agent.original), Esql.event_dataset_values = values(event.dataset), diff --git a/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml b/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml index 08648327c..df9b5d8b4 100644 --- a/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml +++ b/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml @@ -1,8 +1,8 @@ [metadata] creation_date = "2025/11/19" -integration = ["network_traffic", "nginx", "apache", "apache_tomcat", "iis"] +integration = ["nginx", "apache", "apache_tomcat", "iis"] maturity = "production" -updated_date = "2025/11/24" +updated_date = "2025/12/01" [rule] author = ["Elastic"] @@ -52,10 +52,8 @@ rule_id = "8383a8d0-008b-47a5-94e5-496629dc3590" severity = "low" tags = [ "Domain: Web", - "Domain: Network", "Use Case: Threat Detection", "Tactic: Reconnaissance", - "Data Source: Network Packet Capture", "Data Source: Nginx", "Data Source: Apache", "Data Source: Apache Tomcat", @@ -65,14 +63,12 @@ tags = [ timestamp_override = "event.ingested" type = "esql" query = ''' -from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-* +from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-* | where - (url.original is not null or url.full is not null) and http.request.method == "GET" and http.response.status_code in (404, 403) -| eval Esql.url_text = case(url.original is not null, url.original, url.full) -| eval Esql.url_lower = to_lower(Esql.url_text) +| eval Esql.url_original_to_lower = to_lower(url.original) | keep @timestamp, @@ -82,19 +78,19 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access- source.ip, agent.id, host.name, - Esql.url_lower + Esql.url_original_to_lower | stats Esql.event_count = count(), - Esql.url_lower_count_distinct = count_distinct(Esql.url_lower), + Esql.url_original_count_distinct = count_distinct(Esql.url_original_to_lower), Esql.host_name_values = values(host.name), Esql.agent_id_values = values(agent.id), Esql.http_request_method_values = values(http.request.method), Esql.http_response_status_code_values = values(http.response.status_code), - Esql.url_path_values = values(Esql.url_lower), + Esql.url_original_values = values(Esql.url_original_to_lower), Esql.event_dataset_values = values(event.dataset) by source.ip | where - Esql.event_count > 500 and Esql.url_lower_count_distinct > 250 + Esql.event_count > 500 and Esql.url_original_count_distinct > 250 ''' [[rule.threat]] diff --git a/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml b/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml index e51ed9948..aa1d8d192 100644 --- a/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml +++ b/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml @@ -2,7 +2,7 @@ creation_date = "2025/11/19" integration = ["nginx", "apache", "apache_tomcat", "iis"] maturity = "production" -updated_date = "2025/11/25" +updated_date = "2025/12/01" [rule] author = ["Elastic"] @@ -80,7 +80,7 @@ from logs-nginx.error-*, logs-apache_tomcat.error-*, logs-apache.error-*, logs-i Esql.event_dataset_values = values(event.dataset) by source.ip, agent.id | where - Esql.event_count > 25 + Esql.event_count > 50 ''' [[rule.threat]] diff --git a/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml b/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml index 1a8b668a6..3a8f67abd 100644 --- a/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml +++ b/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml @@ -1,8 +1,8 @@ [metadata] creation_date = "2025/11/19" -integration = ["network_traffic", "nginx", "apache", "apache_tomcat", "iis"] +integration = ["nginx", "apache", "apache_tomcat", "iis"] maturity = "production" -updated_date = "2025/11/24" +updated_date = "2025/12/01" [rule] author = ["Elastic"] @@ -53,10 +53,8 @@ rule_id = "6fa3abe3-9cd8-41de-951b-51ed8f710523" severity = "low" tags = [ "Domain: Web", - "Domain: Network", "Use Case: Threat Detection", "Tactic: Reconnaissance", - "Data Source: Network Packet Capture", "Data Source: Nginx", "Data Source: Apache", "Data Source: Apache Tomcat", @@ -66,9 +64,8 @@ tags = [ timestamp_override = "event.ingested" type = "esql" query = ''' -from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-* +from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-* | where - (url.original is not null or url.full is not null) and http.request.method == "GET" and http.response.status_code in ( 500, // Internal Server Error @@ -76,8 +73,8 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access- 503, // Service Unavailable 504 // Gateway Timeout ) -| eval Esql.url_text = case(url.original is not null, url.original, url.full) -| eval Esql.url_lower = to_lower(Esql.url_text) + +| eval Esql.url_original_to_lower = to_lower(url.original) | keep @timestamp, @@ -87,7 +84,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access- source.ip, agent.id, host.name, - Esql.url_lower + Esql.url_original_to_lower | stats Esql.event_count = count(), Esql.http_response_status_code_count = count(http.response.status_code), @@ -96,7 +93,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access- Esql.agent_id_values = values(agent.id), Esql.http_request_method_values = values(http.request.method), Esql.http_response_status_code_values = values(http.response.status_code), - Esql.url_path_values = values(Esql.url_lower), + Esql.url_path_values = values(Esql.url_original_to_lower), Esql.event_dataset_values = values(event.dataset) by source.ip, agent.id | where diff --git a/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml b/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml index c5be6ae82..3c8e9d93a 100644 --- a/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml +++ b/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml @@ -1,8 +1,8 @@ [metadata] creation_date = "2025/11/19" -integration = ["nginx", "apache", "apache_tomcat", "iis", "network_traffic"] +integration = ["nginx", "apache", "apache_tomcat", "iis"] maturity = "production" -updated_date = "2025/11/24" +updated_date = "2025/12/01" [rule] author = ["Elastic"] @@ -52,11 +52,9 @@ rule_id = "a1b7ffa4-bf80-4bf1-86ad-c3f4dc718b35" severity = "low" tags = [ "Domain: Web", - "Domain: Network", "Use Case: Threat Detection", "Tactic: Reconnaissance", "Tactic: Credential Access", - "Data Source: Network Packet Capture", "Data Source: Nginx", "Data Source: Apache", "Data Source: Apache Tomcat", @@ -66,40 +64,34 @@ tags = [ timestamp_override = "event.ingested" type = "esql" query = ''' -from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-* +from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-* -| eval Esql.user_agent_original_lower = to_lower(user_agent.original) +| eval Esql.user_agent_original_to_lower = to_lower(user_agent.original), Esql.url_original_to_lower = to_lower(url.original) | where - (url.original is not null or url.full is not null) and - ( - Esql.user_agent_original_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/74.0.3729.169 safari/537.36" or // Nikto - Esql.user_agent_original_lower like "nikto*" or // Nikto - Esql.user_agent_original_lower like "mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)" or // Nessus Vulnerability Scanner - Esql.user_agent_original_lower like "*nessus*" or // Nessus Vulnerability Scanner - Esql.user_agent_original_lower like "sqlmap/*" or // SQLMap - Esql.user_agent_original_lower like "wpscan*" or // WPScan - Esql.user_agent_original_lower like "feroxbuster/*" or // Feroxbuster - Esql.user_agent_original_lower like "masscan*" or // Masscan & masscan-ng - Esql.user_agent_original_lower like "fuzz*" or // Ffuf - Esql.user_agent_original_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/user_agent.original like~ 87.0.4280.88 safari/537.36" or // Dirsearch - Esql.user_agent_original_lower like "mozilla/4.0 (compatible; msie 6.0; windows nt 5.1)" or // Dirb - Esql.user_agent_original_lower like "dirbuster*" or // Dirbuster - Esql.user_agent_original_lower like "gobuster/*" or // Gobuster - Esql.user_agent_original_lower like "*dirsearch*" or // dirsearch - Esql.user_agent_original_lower like "*nmap*" or // Nmap Scripting Engine - Esql.user_agent_original_lower like "*hydra*" or // Hydra Brute Forcer - Esql.user_agent_original_lower like "*w3af*" or // w3af Web Application Attack and Audit Framework - Esql.user_agent_original_lower like "*arachni*" or // Arachni Web Application Security Scanner - Esql.user_agent_original_lower like "*skipfish*" or // Skipfish Web Application Security Scanner - Esql.user_agent_original_lower like "*openvas*" or // OpenVAS Vulnerability Scanner - Esql.user_agent_original_lower like "*acunetix*" or // Acunetix Vulnerability Scanner - Esql.user_agent_original_lower like "*zap*" or // OWASP ZAP - Esql.user_agent_original_lower like "*burp*" // Burp Suite - ) - -| eval Esql.url_text = case(url.original is not null, url.original, url.full) -| eval Esql.url_lower = to_lower(Esql.url_text) + Esql.user_agent_original_to_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/74.0.3729.169 safari/537.36" or // Nikto + Esql.user_agent_original_to_lower like "nikto*" or // Nikto + Esql.user_agent_original_to_lower like "mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)" or // Nessus Vulnerability Scanner + Esql.user_agent_original_to_lower like "*nessus*" or // Nessus Vulnerability Scanner + Esql.user_agent_original_to_lower like "sqlmap/*" or // SQLMap + Esql.user_agent_original_to_lower like "wpscan*" or // WPScan + Esql.user_agent_original_to_lower like "feroxbuster/*" or // Feroxbuster + Esql.user_agent_original_to_lower like "masscan*" or // Masscan & masscan-ng + Esql.user_agent_original_to_lower like "fuzz*" or // Ffuf + Esql.user_agent_original_to_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/user_agent.original like~ 87.0.4280.88 safari/537.36" or // Dirsearch + Esql.user_agent_original_to_lower like "mozilla/4.0 (compatible; msie 6.0; windows nt 5.1)" or // Dirb + Esql.user_agent_original_to_lower like "dirbuster*" or // Dirbuster + Esql.user_agent_original_to_lower like "gobuster/*" or // Gobuster + Esql.user_agent_original_to_lower like "*dirsearch*" or // dirsearch + Esql.user_agent_original_to_lower like "*nmap*" or // Nmap Scripting Engine + Esql.user_agent_original_to_lower like "*hydra*" or // Hydra Brute Forcer + Esql.user_agent_original_to_lower like "*w3af*" or // w3af Web Application Attack and Audit Framework + Esql.user_agent_original_to_lower like "*arachni*" or // Arachni Web Application Security Scanner + Esql.user_agent_original_to_lower like "*skipfish*" or // Skipfish Web Application Security Scanner + Esql.user_agent_original_to_lower like "*openvas*" or // OpenVAS Vulnerability Scanner + Esql.user_agent_original_to_lower like "*acunetix*" or // Acunetix Vulnerability Scanner + Esql.user_agent_original_to_lower like "*zap*" or // OWASP ZAP + Esql.user_agent_original_to_lower like "*burp*" // Burp Suite | keep @timestamp, @@ -108,19 +100,19 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access- source.ip, agent.id, host.name, - Esql.url_lower, - Esql.user_agent_original_lower + Esql.url_original_to_lower, + Esql.user_agent_original_to_lower | stats Esql.event_count = count(), - Esql.url_path_count_distinct = count_distinct(Esql.url_lower), + Esql.url_original_count_distinct = count_distinct(Esql.url_original_to_lower), Esql.host_name_values = values(host.name), Esql.agent_id_values = values(agent.id), - Esql.url_path_values = values(Esql.url_lower), - Esql.user_agent_original_values = values(Esql.user_agent_original_lower), + Esql.url_original_values = values(Esql.url_original_to_lower), + Esql.user_agent_original_values = values(Esql.user_agent_original_to_lower), Esql.event_dataset_values = values(event.dataset) by source.ip, agent.id | where - Esql.event_count > 50 and Esql.url_path_count_distinct > 10 + Esql.event_count > 50 and Esql.url_original_count_distinct > 10 ''' [[rule.threat]]