// ha-mcp bare-root administration access
// Adapt table and field names to your ingestion schema.

let SupervisorIngressIp = "172.30.32.2";
McpHttpAccess_CL
| extend
    SrcIp = tostring(SourceIp_s),
    Method = toupper(tostring(HttpMethod_s)),
    Path = tostring(UriPath_s),
    Status = toint(StatusCode_d),
    DstPort = toint(DestinationPort_d),
    Host = tostring(Computer)
| where DstPort == 9583
| where Path startswith "/api/settings/"
    or Path startswith "/api/policy/"
| extend
    IsStateChanging = Method in ("POST", "PUT", "PATCH", "DELETE"),
    IsSupervisor = SrcIp == SupervisorIngressIp,
    DetectionReason = case(
        not(IsSupervisor) and IsStateChanging, "Non-Supervisor state-changing admin request",
        not(IsSupervisor), "Non-Supervisor root admin request",
        Status == 403, "Ingress guard rejection",
        "Supervisor request"
    )
| where not(IsSupervisor) or Status == 403
| summarize
    RequestCount = count(),
    Methods = make_set(Method),
    Paths = make_set(Path, 25),
    Statuses = make_set(Status),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by Host, SrcIp, DetectionReason, bin(TimeGenerated, 5m)
| order by LastSeen desc