High Volume of IIS Server Errors Detected
This rule detects a high volume of server errors (HTTP status codes 500, 502, or 503) from IIS web servers within a 5-minute window. A count of 20 or more server errors in this timeframe triggers the alert, indicating potential issues with the web application, backend services, or a denial-of-service attempt.
Microsoft Sentinel (KQL)
