Akamai WAF: Broad Scanning or Reconnaissance Activity
This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.
Splunk (SPL)
