from logs-aws.cloudtrail*

| where
  event.provider == "s3.amazonaws.com"
  and aws.cloudtrail.error_code == "AccessDenied"
  and tls.client.server_name is not null
  and cloud.account.id is not null

// keep only relevant ECS fields
| keep
  tls.client.server_name,
  source.address,
  cloud.account.id

// count access denied requests per server_name, source, and account
| stats
    Esql.event_count = count(*)
  by
    tls.client.server_name,
    source.address,
    cloud.account.id

// Threshold: more than 40 denied requests
| where Esql.event_count > 40