✄𐘗
text code block:
✄𐘗from logs-network_traffic.sip-*, packetbeat-* metadata _source
| eval
    Esql.method = TO_UPPER(COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.method"),
        JSON_EXTRACT(_source, "sip.method")
    )),
    Esql.to_user = COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.to.uri.username"),
        JSON_EXTRACT(_source, "sip.to.uri.username")
    ),
    Esql.user_agent = COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.user_agent.original"),
        JSON_EXTRACT(_source, "sip.user_agent.original")
    ),
    Esql.client_ip = COALESCE(client.ip, source.ip),
    Esql.server_ip = COALESCE(server.ip, destination.ip)
| where
    Esql.method == "OPTIONS" and
    Esql.to_user is not null and
    Esql.client_ip is not null and
    Esql.server_ip is not null
| eval Esql.time_window = DATE_TRUNC(2 minutes, @timestamp)
| stats
    Esql.distinct_extensions = COUNT_DISTINCT(Esql.to_user),
    Esql.request_count = COUNT(*),
    Esql.sample_extensions = MV_SLICE(VALUES(Esql.to_user), 0, 20),
    Esql.user_agents = MV_SLICE(VALUES(Esql.user_agent), 0, 10)
  by Esql.time_window, Esql.client_ip, Esql.server_ip
| where Esql.distinct_extensions >= 20
| keep Esql.*