IT Management Platform Remote Access Session
This rule detects HTTP requests to URIs containing keywords associated with common IT management platforms (ConnectWise, Kaseya, SolarWinds, Datto, N-central). It specifically looks for established HTTP traffic flowing to the server. A threshold of 5 occurrences within 60 seconds from the same source IP is set to trigger an alert, indicating a potential remote access session or activity related to these platforms.
Suricata
