index=mcp sourcetype=mcp:http dest_port=9583
(uri_path="/api/settings/*" OR uri_path="/api/policy/*")
| eval method=upper(method)
| where src_ip!="172.30.32.2" OR status=403
| eval detection_reason=case(
    src_ip!="172.30.32.2" AND method IN ("POST","PUT","PATCH","DELETE"),
        "non_supervisor_state_change",
    src_ip!="172.30.32.2",
        "non_supervisor_root_admin_access",
    status=403,
        "ingress_guard_rejection",
    true(),
        "other"
)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(method) as methods values(uri_path) as paths values(status) as statuses
        by host src_ip detection_reason
| convert ctime(first_seen) ctime(last_seen)