Elastic low stable kql

Potential Spike in Web Server Error Logs

This rule detects unusual spikes in error logs from web servers, which may indicate reconnaissance activities such as vulnerability scanning or fuzzing attempts by adversaries. These activities often generate a high volume of error responses as they probe for weaknesses in web applications. Error response codes may potentially indicate server-side issues that could be exploited.

View Source

Detection Logic

from logs-nginx.error-*, logs-apache_tomcat.error-*, logs-apache.error-*, logs-iis.error-*
| keep
    @timestamp,
    event.type,
    data_stream.dataset,
    source.ip,
    agent.id,
    host.name,
    data_stream.namespace
| where source.ip is not null
| stats
    Esql.event_count = count(),
    Esql.host_name_values = values(host.name),
    Esql.agent_id_values = values(agent.id),
    Esql.data_stream_dataset_values = values(data_stream.dataset),
    Esql.data_stream_namespace_values = values(data_stream.namespace)
    by source.ip, agent.id
| where
    Esql.event_count > 50

Field Validations

Loading…

Comments (0)

Loading comments...