Corelight - Network Service Scanning Multiple IP Addresses

Requête originale, sans modification.

let threshold = 25;
union isfuzzy=true corelight_conn, corelight_conn_agg
| where local_resp == true
| where local_orig == true
| where conn_state in~ ('S0', 'REJ')
| where history !contains 'D'
| summarize count() by id_orig_h, id_resp_p, bin(TimeGenerated, 1m)
| where count_ > threshold