Update WebShellActivity.yaml

Exclude local addresses, using the ipv4_is_private operator

Hunting Queries/W3CIISLog/WebShellActivity.yaml

@@ -25,7 +25,8 @@ query: |
   let lookback_period = (
   W3CIISLog
   | where TimeGenerated between (lookback .. starttime)
-  | where not(ipv4_is_private(cIP)) and cIP != "127.0.0.1"
+  //Exclude local addresses, using the ipv4_is_private operator
+  | where ipv4_is_private(cIP) == false and  cIP !startswith "fe80" and cIP !startswith "::" and cIP !startswith "127."
   | summarize count() by cIP, csUserAgent
   | project cIP, csUserAgent
   );