// Illustrative; not run against live data. Microsoft Sentinel, W3CIISLog (IIS). Adapt the column names for other web, API gateway or WAF logs.
// Admin functions reached from outside the networks your administrators use.
// List your admin paths and the address ranges allowed to use them; every other source in the result needs an explanation.
let Since = ago(30d);
let AdminPaths = @"(?i)REPLACE_WITH_ADMIN_PATH_PATTERN";
let AdminRanges = dynamic(["REPLACE_WITH_ADMIN_CIDR_1", "REPLACE_WITH_ADMIN_CIDR_2"]);
W3CIISLog
| where TimeGenerated > Since
| where csUriStem matches regex AdminPaths
| where not(ipv4_is_in_any_range(cIP, AdminRanges))
| summarize Requests = count(), Succeeded = countif(toint(scStatus) between (200 .. 299)), Paths = make_set(csUriStem, 20),
    Users = make_set(csUserName, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP
| order by Succeeded desc, Requests desc
| take 500