topic Re: Alert if same traffic log entry is repeated N times.. in General Topics

Alert if same traffic log entry is repeated N times..

RobinClayton — Fri, 11 Oct 2019 10:20:32 GMT

We have had an instance of a third party having an issue with their system that generated repeated traffic over and over 17K 5 times a second, constantly.

I can match the traffic in the log fairly easily.

How can I set up an alert for that to go to our application owner?

I can't figure out a way to do it other than a daily scheduled report which is not great.

Rob

Re: Alert if same traffic log entry is repeated N times..

OtakarKlier — Fri, 11 Oct 2019 20:19:27 GMT

Hello,

A SIEM is your best bet at that point. While there are reporting functions on the device, a SIEM can do a lot better. Also perhaps a zone protection or DOS policy could help out?

Regards,

Re: Alert if same traffic log entry is repeated N times..

RobinClayton — Mon, 14 Oct 2019 10:41:50 GMT

Hmm... SIEM is not implemented yet although it's budgeted and we have gone through the entire selection process.. It's just queued down the project list..

Will have to have a think.