Query: restricted_file_access

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  request_uri is not null
  and (
    -- Common application config files
    request_uri ilike '%/config.php%'
    or request_uri ilike '%/configuration.php%'
    or request_uri ilike '%/db.php%'
    or request_uri ilike '%/database.php%'
    or request_uri ilike '%/settings.php%'
    or request_uri ilike '%/conf.php%'
    or request_uri ilike '%/wp-config.php%'
    or request_uri ilike '%/config.xml%'
    or request_uri ilike '%/app.config%'
    or request_uri ilike '%/appsettings.json%'
    or request_uri ilike '%/config.yml%'
    or request_uri ilike '%/config.yaml%'
    or request_uri ilike '%/.env%'
    or request_uri ilike '%/.htaccess%'
    or request_uri ilike '%/.svn/%'
    or request_uri ilike '%/.git/%'
    -- Popular application source files
    or request_uri ilike '%/web.config%'
    or request_uri ilike '%/php.ini%'
    or request_uri ilike '%/.htpasswd%'
    or request_uri ilike '%.inc%'
    -- Temporary or backup files that may contain sensitive data
    or request_uri ilike '%~%'
    or request_uri ilike '%.bak%'
    or request_uri ilike '%.backup%'
    or request_uri ilike '%.old%'
    or request_uri ilike '%.orig%'
    or request_uri ilike '%.tmp%'
    or request_uri ilike '%.temp%'
    or request_uri ilike '%.swp%'
  )
order by
  tp_timestamp desc;