// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Falcon NG-SIEM CPS web logs. REQUIRED time picker: last 1 hour.
// Profile only: no universal 2-25s or 25-31s AI threshold. Compare with the app's baseline and independent evidence.
// One source/app, principal required. Oldest 10,000 inputs retained; at most 100 groups.
#type="REPLACE_WITH_WEB_PARSER" source.ip="REPLACE_WITH_SOURCE_IP" url.domain="REPLACE_WITH_APP_HOST" user.id=* url.path=*
| sort(@timestamp, order=asc, limit=10000)
| t := @timestamp
| groupBy([source.ip, url.domain, user.id], function=neighbor(include=[t, url.path], prefix=prev), limit=max)
| GapSeconds := (t - prev.t) / 1000
| test(GapSeconds >= 0 and GapSeconds <= 600)
| groupBy([source.ip, url.domain, user.id], function=[count(as=Gaps), count(url.path, distinct=true, as=DistinctPaths), min(GapSeconds, as=MinGap), max(GapSeconds, as=MaxGap), percentile(field=GapSeconds, percentiles=[10,50,90])], limit=100)
| Gaps >= 20
| head(limit=100)