High Rate Web Access - Business Tempo Recon

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects a high rate of HTTP GET requests from a single source IP address to internal web servers, indicating a potential reconnaissance activity. Specifically, it triggers if a source IP makes 50 or more HTTP GET requests within a 30-second window. This behavior could be indicative of an attacker attempting to map out web application structure or discover vulnerabilities.