Update reconnaissance_web_server_discovery_or_fuzzing_activity.toml

Aegrah · Aegrah · commit 0aa4c73425c9 · 2025-11-24T16:04:21.000+01:00
diff --git a/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml b/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml
@@ -69,7 +69,6 @@ from
     by source.ip
 | where
   Esql.event_count > 500 and Esql.url_lower_count_distinct > 250
-| limit 100
 '''
 
 [[rule.threat]]
