{
  "type": "monitor",
  "monitor_type": "query_level_monitor",
  "name": "Traffic tried to bypass the VPN",
  "enabled": true,
  "schedule": { "period": { "interval": 5, "unit": "MINUTES" } },
  "inputs": [{
    "search": {
      "indices": ["fw-pf-*"],
      "query": {
        "size": 10,
        "_source": ["@timestamp", "message", "source.hostname"],
        "query": { "bool": { "filter": [
          { "term": { "rule.name": "block_wan_leak" } },
          { "range": { "@timestamp": { "gte": "{{period_end}}||-5m", "lte": "{{period_end}}", "format": "epoch_millis" } } }
        ] } }
      }
    }
  }],
  "triggers": [{
    "name": "Kill switch layer 2 blocked traffic on WAN",
    "severity": "1",
    "condition": { "script": { "source": "ctx.results[0].hits.total.value > 0", "lang": "painless" } },
    "actions": []
  }]
}