// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Falcon NG-SIEM: access logs from YOUR Cairn reverse proxy, not requests sent to third-party panels.
// REQUIRED time picker: last 1 hour; one owned host + triaged source IP; at most 100 groups.
// Pinned Cairn /settings and /projects routes; verify approval and principal in application/auth logs.
#type="REPLACE_WITH_WEB_PARSER" url.domain="REPLACE_WITH_OWNED_CONSOLE_HOST" source.ip="REPLACE_WITH_SOURCE_IP"
| url.path=/^\/(?:settings|projects)(?:\/|$)/i
| case {
    http.request.method=/^(POST|PUT|PATCH|DELETE)$/i ;
    url.path=/\/export\/?$/i ;
  }
| http.response.status_code=/^2[0-9]{2}$/
| groupBy([source.ip, url.domain, url.path, http.request.method], function=[count(as=Requests), collect([user.id, http.response.status_code], limit=10)], limit=100)
| head(limit=100)