id: http_errors
version: 1
meta:
  name: Multiple HTTP errors found
  description: >
    Non-successful HTTP error codes were encountered. 401 and 403
    are not included as these refer to authentication/authorization
    failures.
  risk: LOW
collections:
  - collect:
      - method: exact
        field: type
        value: HTTP_CODE
      - method: regex
        field: data
        value: ^[4-9].*$
      # Leave out authentication/authorization failures
      - method: regex
        field: data
        value: not 40[13]
aggregation:
  field: entity.data
analysis:
  - method: threshold
    minimum: 2
    field: data
headline: "Multiple failure HTTP codes found at {entity.data}"
