LoFP LoFP / authorized administrators or automation may purge multiple queues during maintenance, testing, disaster recovery, or application resets. confirm the client, authenticated rabbitmq user, affected queues, and change window before escalating. add exceptions for verified administrative sources rather than reducing the queue-cardinality threshold.

Techniques

Sample rules

Successful AMQP Multi-Queue Purge Burst

Description

Identifies multiple successful AMQP queue purge operations issued by the same client to the same broker within a short period. The AMQP queue.purge method removes all messages from a queue that are not awaiting acknowledgment. Purging several distinct queues can indicate deliberate message destruction or disruption after broker credentials are compromised.

Detection logic

FROM logs-network_traffic.amqp-*
| WHERE
    data_stream.dataset == "network_traffic.amqp" AND
    network_traffic.amqp.method == "queue.purge" AND
    network_traffic.amqp.`no-wait` == false AND
    network_traffic.status == "OK" AND
    client.ip IS NOT NULL AND
    server.ip IS NOT NULL AND
    network_traffic.amqp.queue IS NOT NULL
| STATS
    Esql.purge_count = COUNT(*),
    Esql.queue_count = COUNT_DISTINCT(network_traffic.amqp.queue),
    Esql.queues = VALUES(network_traffic.amqp.queue),
    Esql.first_purge = MIN(@timestamp),
    Esql.last_purge = MAX(@timestamp)
  BY client.ip, server.ip
| WHERE Esql.purge_count >= 3 AND Esql.queue_count >= 3
| SORT Esql.queue_count DESC, Esql.purge_count DESC
| KEEP client.ip, server.ip, Esql.purge_count, Esql.queue_count, Esql.queues, Esql.first_purge, Esql.last_purge