es_query_web_attacks.json

{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": "now-7d/d",
              "lt": "now/d"
            }
          }
        },
        {
          "term": {
            "event_type": {
              "value": "alert"
            }
          }
        },
        {
          "term": {
            "alert.severity": {
              "value": 1
            }
          }
        },
        {
          "wildcard": {
            "alert.category.keyword": {
              "value": "*Web*"
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "src_geoip.country_iso_code.keyword": {
              "value": "EE"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "topHost": {
      "terms": {
        "field": "http.hostname.keyword",
        "size": 25
      },
      "aggs": {
        "SignificantURL": {
          "significant_terms": {
            "field": "http.url.keyword"
          },
          "aggs": {
            "topSrc": {
              "terms": {
                "field": "src_ip.keyword",
                "size": 10
              }
            }
          }
        }
      }
    },
    "topCountry": {
      "terms": {
        "field": "src_geoip.country_iso_code.keyword",
        "size": 10
      }
    }
  }
}