High Volume of Web Search Queries from Single IP

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.