| tstats summariesonly=true count FROM datamodel=Web WHERE earliest=-7d BY Web.src Web.status Web.uri_path _time span=1h
| rename Web.* AS *
| search NOT src IN ("REPLACE_WITH_CORPORATE_EGRESS_IP")
| eval denied=if(in(status, "401", "403"), count, 0), not_found=if(status="404", count, 0), succeeded=if(match(status, "^2"), count, 0)
| stats sum(denied) AS denied sum(not_found) AS not_found sum(succeeded) AS succeeded dc(uri_path) AS routes BY _time src
| where denied + not_found >= 50 AND routes >= 10
| eval then_succeeded=if(succeeded > 0, "yes", "no")
| sort 0 - denied