This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

Hi @MakoWish, thanks for the issue. I am currently looking into several web-server-based detection, and was wondering about the additional integrations that you added to the rule. You listed:

"network_traffic", "azure", "apm", "apache", "cisco_ftd", "iis", "microsoft_exchange_server"

I know that network_traffic, apache and iis indeed are compatible with the http.response.status_code field. Are you sure that the others are as well?

Also, if possible, it would help me out a lot to get a redacted event for the other data sources, so that I can make sure that the rules I write are compatible. E.g.:

The following fields can be used across integrations:

• user_agent.original
• url.path
• http.response.status_code
• http.request.method --> caveat: not always populated

For URL-specific detections:

• url.original: Apache, IIS, Nginx
• url.full: NPC

If I can make the list of confirmed compatible integrations longer, I can make the rules more broadly compatible. Thank you!