// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Falcon NG-SIEM CPS web logs. REQUIRED time picker: last 1 hour.
// Same host, path and principal. Resource identity must be in path; preserve intervening methods.
// Up to 10,000 oldest matching inputs; split busy windows. At most 100 groups.
#type="REPLACE_WITH_WEB_PARSER" source.ip="REPLACE_WITH_SOURCE_IP" url.domain="REPLACE_WITH_APP_HOST" user.id=* url.path=*
| sort(@timestamp, order=asc, limit=10000)
| t := @timestamp
| groupBy([source.ip, url.domain, url.path, user.id], function=neighbor(include=[t, http.request.method, http.response.status_code], prefix=prev), limit=max)
| http.request.method=/^(POST|PUT|PATCH)$/i prev.http.request.method=/^(POST|PUT|PATCH)$/i
| prev.http.response.status_code=/^(400|422|500)$/ http.response.status_code=/^2[0-9]{2}$/
| gap := t - prev.t
| test(gap > 0 and gap <= 180000)
| groupBy([source.ip, url.domain, user.id], function=[count(as=Transitions), collect([url.path], limit=10)], limit=100)
| Transitions >= 2
| head(limit=100)