Elastic high stable kql

Successful AMQP Multi-Queue Purge Burst

Identifies multiple successful AMQP queue purge operations issued by the same client to the same broker within a short period. The AMQP queue.purge method removes all messages from a queue that are not awaiting acknowledgment. Purging several distinct queues can indicate deliberate message destruction or disruption after broker credentials are compromised.

View Source

Detection Logic

FROM logs-network_traffic.amqp-*
| WHERE
    data_stream.dataset == "network_traffic.amqp" 
AND
    network_traffic.amqp.method == "queue.purge" 
AND
    network_traffic.amqp.`no-wait` == false 
AND
    network_traffic.status == "OK" 
AND
    client.ip IS NOT NULL 
AND
    server.ip IS NOT NULL 
AND
    network_traffic.amqp.queue IS NOT NULL
| STATS
    Esql.purge_count = COUNT(*),
    Esql.queue_count = COUNT_DISTINCT(network_traffic.amqp.queue),
    Esql.queues = VALUES(network_traffic.amqp.queue),
    Esql.first_purge = MIN(@timestamp),
    Esql.last_purge = MAX(@timestamp)
  BY client.ip, server.ip
| WHERE Esql.purge_count >= 3 
AND Esql.queue_count >= 3
| SORT Esql.queue_count DESC, Esql.purge_count DESC
| KEEP client.ip, server.ip, Esql.purge_count, Esql.queue_count, Esql.queues, Esql.first_purge, Esql.last_purge

False Positives

⚠ Authorized administrators or automation may purge multiple queues during maintenance, testing, disaster recovery, or application resets. Confirm the client, authenticated RabbitMQ user, affected queues, and change window before escalating. Add exceptions for verified administrative sources rather than reducing the queue-cardinality threshold.

Field Validations

Loading…

Comments (0)

Loading comments...