Detect Application Exhaustion Flood in Elastic Security

sequence by source.ip, url.domain with maxspan=5m
  [network where event.dataset in ("iis.access", "apache.access", "nginx.access") and
   (url.path : ("*/search*", "*/query*", "*/find*", "*/report*", "*/export*", "*/download*",
                "*/generate*", "*/convert*", "*/login*", "*/authenticate*", "*/auth*",
                "*/oauth*", "*/signin*", "*/graphql*", "*/wp-login.php*", "*/xmlrpc.php*",
                "*/wp-admin*", "*/rest/api*", "*/odata*", "*/api/*")
    or http.response.body.bytes > 0)
  ] with runs=50

// Alternative aggregation-style query using stats:
// from logs-*
// | where event.dataset in ("iis.access", "apache.access", "nginx.access")
// | where @timestamp > now() - 1h
// | where url.path LIKE "%search%" or url.path LIKE "%graphql%" or url.path LIKE "%login%" or event.duration > 5000000000
// | stats
//     request_count = count(),
//     avg_duration_ms = avg(event.duration / 1000000),
//     max_duration_ms = max(event.duration / 1000000),
//     unique_endpoints = count_distinct(url.path),
//     server_errors = sum(case(http.response.status_code >= 500, 1, 0)),
//     rate_limited = sum(case(http.response.status_code == 429, 1, 0))
//   by source.ip, url.domain, bucket(@timestamp, "5 minutes")
// | where request_count > 300 or (avg_duration_ms > 5000 and request_count > 50) or rate_limited > 10

from logs-*
| where event.dataset in ("iis.access", "apache.access", "nginx.access", "haproxy.log")
| where @timestamp > now() - 1h
| where (url.path like "*search*" or url.path like "*query*" or url.path like "*find*"
    or url.path like "*report*" or url.path like "*export*" or url.path like "*download*"
    or url.path like "*generate*" or url.path like "*convert*" or url.path like "*login*"
    or url.path like "*authenticate*" or url.path like "*graphql*" or url.path like "*wp-login.php*"
    or url.path like "*xmlrpc.php*" or url.path like "*wp-admin*" or url.path like "*rest/api*"
    or url.path like "*odata*" or url.path like "*/api/*")
    or (event.duration / 1000000) > 5000
| stats
    request_count = count(),
    avg_duration_ms = avg(event.duration / 1000000),
    max_duration_ms = max(event.duration / 1000000),
    unique_endpoints = count_distinct(url.path),
    server_errors = count_if(http.response.status_code >= 500, 1),
    rate_limited = count_if(http.response.status_code == 429, 1)
  by source.ip, url.domain, bucket := date_trunc("5 minutes", @timestamp)
| where request_count > 300 or (avg_duration_ms > 5000 and request_count > 50) or rate_limited > 10
| eval threat_score = case(
    request_count > 1000 and avg_duration_ms > 10000, 3,
    request_count > 500 or avg_duration_ms > 8000, 2,
    1)
| eval error_rate = round(server_errors / request_count, 2)
| sort threat_score desc, request_count desc