BOLA via sequential object ID enumeration across API requests
Detects a single authenticated user account or client performing a high volume of requests to sequential object IDs on the same API path within a short window. This pattern is characteristic of Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) exploitation, where an attacker attempts to gain unauthorized access to data records that do not belong to them by iterating through predictable numeric identifiers.
Microsoft Sentinel (KQL)
