✄𐘗
text code block:
✄𐘗from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    event.outcome == "success" and
    source.ip is not null and
    source.ip != "0.0.0.0" and
    user.email is not null and
    user_agent.original is not null
| eval Esql.ua_lower = to_lower(user_agent.original)
| where
    (
        Esql.ua_lower like "curl*" or
        Esql.ua_lower like "python*" or
        Esql.ua_lower like "wget*" or
        Esql.ua_lower like "go-http*" or
        Esql.ua_lower like "perl*" or
        Esql.ua_lower like "libwww-perl*" or
        Esql.ua_lower like "java*" or
        Esql.ua_lower like "node*" or
        Esql.ua_lower like "php*" or
        Esql.ua_lower like "guzzle*" or
        Esql.ua_lower like "bun*" or
        Esql.ua_lower like "axios*" or
        Esql.ua_lower like "undici*" or
        Esql.ua_lower like "okhttp*" or
        Esql.ua_lower like "apache-httpclient*" or
        Esql.ua_lower like "httpclient*" or
        Esql.ua_lower like "httpie*" or
        Esql.ua_lower like "ruby*" or
        Esql.ua_lower like "postmanruntime*" or
        Esql.ua_lower like "restsharp*" or
        Esql.ua_lower like "*kali*" or
        Esql.ua_lower like "*parrot*" or
        Esql.ua_lower like "*pentoo*" or
        Esql.ua_lower like "*backbox*" or
        Esql.ua_lower like "*blackarch*" or
        Esql.ua_lower like "scrapy*" or
        Esql.ua_lower like "mechanize*" or
        Esql.ua_lower like "aiohttp*" or
        Esql.ua_lower like "httpx*" or
        Esql.ua_lower like "requests*" or
        Esql.ua_lower like "pycurl*" or
        Esql.ua_lower like "urllib*" or
        Esql.ua_lower like "got/*" or
        Esql.ua_lower like "node-fetch*" or
        Esql.ua_lower like "superagent*" or
        Esql.ua_lower like "ky/*" or
        Esql.ua_lower like "fetch*" or
        Esql.ua_lower like "deno*" or
        Esql.ua_lower like "powershell*" or
        Esql.ua_lower like "invoke-webrequest*" or
        Esql.ua_lower like "windowspowershell*" or
        Esql.ua_lower like "wget2*" or
        Esql.ua_lower like "aria2*" or
        Esql.ua_lower like "httrack*" or
        Esql.ua_lower like "nikto*" or
        Esql.ua_lower like "sqlmap*" or
        Esql.ua_lower like "nmap*" or
        Esql.ua_lower like "masscan*" or
        Esql.ua_lower like "zgrab*" or
        Esql.ua_lower like "nuclei*" or
        Esql.ua_lower like "dirbuster*" or
        Esql.ua_lower like "gobuster*" or
        Esql.ua_lower like "ffuf*" or
        Esql.ua_lower like "feroxbuster*" or
        Esql.ua_lower like "wfuzz*" or
        Esql.ua_lower like "burpsuite*" or
        Esql.ua_lower like "hydra*" or
        Esql.ua_lower like "metasploit*" or
        Esql.ua_lower like "*havoc*" or
        Esql.ua_lower like "*sliver*" or
        Esql.ua_lower like "*cobalt strike*" or
        Esql.ua_lower like "dart*" or
        Esql.ua_lower like "rector*" or
        Esql.ua_lower like "ruby-faraday*" or
        Esql.ua_lower like "httparty*" or
        Esql.ua_lower like "clj-http*" or
        Esql.ua_lower like "hackney*" or
        Esql.ua_lower like "elixir*" or
        Esql.ua_lower like "swift-nio*" or
        Esql.ua_lower like "vapor*" or
        Esql.ua_lower like "rust*" or
        Esql.ua_lower like "reqwest*" or
        Esql.ua_lower like "ureq*" or
        Esql.ua_lower like "hyper/*" or
        Esql.ua_lower like "cohere-go*" or
        Esql.ua_lower like "openai*" or
        Esql.ua_lower like "anthropic-sdk*" or
        Esql.ua_lower like "langchain*" or
        Esql.ua_lower like "llamaindex*" or
        Esql.ua_lower like "litellm*" or
        Esql.ua_lower like "dspy*" or
        Esql.ua_lower like "*zgrab*" or
        Esql.ua_lower like "*masscan*" or
        Esql.ua_lower like "*nessus*" or
        Esql.ua_lower like "*shodan*" or
        Esql.ua_lower like "*censys*" or
        Esql.ua_lower like "*binaryedge*" or
        Esql.ua_lower like "*internetmeasurement*" or
        Esql.ua_lower like "*internetcensus*" or
        Esql.ua_lower like "*shadowserver*" or
        Esql.ua_lower like "*stretchoid*" or
        Esql.ua_lower like "*http.rb*"
    ) and
    not (
        event.action in (
            "platform_file_deleted",
            "platform_file_uploaded",
            "claude_file_uploaded",
            "trusted_device_enrolled",
            "environment_created"
        ) and
        (Esql.ua_lower like "go-http*" or Esql.ua_lower like "axios*")
    )
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*, Esql.ua_lower