Unusual HTTP OPTIONS/TRACE Methods Detected

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•3

This rule detects an unusual number of HTTP OPTIONS or TRACE method requests from a single IP address within a one-hour window. While these methods have legitimate uses, their frequent or excessive use can indicate reconnaissance, vulnerability scanning, or attempts to bypass security controls. The rule triggers if 5 or more such requests are observed from the same IP within an hour.