✄𐘗
text code block:
✄𐘗FROM logs-panw.panos-*, filebeat-* metadata _id

// exclude Informational and Low severity levels (4 and 5)
| where event.dataset == "panw.panos" and TO_INTEGER(event.severity) <= 3 and event.action != "flood_detected"

| STATS Esql.alerts_count = count(*),
        Esql.first_time_seen = MIN(@timestamp),
        Esql.distinct_count_src_ip = COUNT_DISTINCT(source.ip),
        Esql.distinct_count_dst_ip = COUNT_DISTINCT(destination.ip),
        src_ip = VALUES(source.ip),
        dst_ip = VALUES(destination.ip),
        url_dom = VALUES(url.domain),
        url_path = VALUES(url.path) by rule.name, event.action, event.type, event.kind, event.severity

// first time seen is within 10m of the rule execution time within last 5 days
| eval Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now())
| where Esql.recent <= 10 and Esql.alerts_count <= 5 and Esql.distinct_count_src_ip <= 2 and Esql.distinct_count_dst_ip <= 2

// move dynamic fields to ECS quivalent for rule exceptions
| eval source.ip = MV_FIRST(src_ip),
       destination.ip = MV_FIRST(dst_ip),
       url.domain = MV_FIRST(url_dom),
       url.path = MV_FIRST(url_path)
| keep rule.name, event.*, Esql.*, source.ip, destination.ip, url.domain, url.path