High-volume or large-response requests to Request Tracker paths per source (15m)

Detects potential vulnerability scanning, enumeration, or bulk data extraction against Request Tracker (RT) web paths by monitoring high request volumes, distinct URI counts, or large response byte sizes within CommonSecurityLog data.