Detections

index=web (uri_path="*" OR api_path="*") | where isnotnull(src_ip) | stats count min(_time) as first_seen max(_time) as last_seen dc(status) as status_variety by src_ip, uri_path, status | sort -count

WebRequests
| where tostring(url) contains '/'
| summarize count(), makeset(httpStatus),
  min(datetime), max(datetime) by sourceIp, url
| order by count_ desc