Alert if same traffic log entry is repeated N times..

[RobinClayton]

We have had an instance of a third party having an issue with their system that generated repeated traffic over and over 17K 5 times a second, constantly.

I can match the traffic in the log fairly easily. 

How can I set up an alert for that to go to our application owner? 

I can't figure out a way to do it other than a daily scheduled report which is not great.

Rob

[OtakarKlier]

Hello,

A SIEM is your best bet at that point. While there are reporting functions on the device, a SIEM can do a lot better. Also perhaps a zone protection or DOS policy could help out?

Regards,

[RobinClayton]

Hmm... SIEM is not implemented yet although it's budgeted and we have gone through the entire selection process.. It's just queued down the project list..

Will have to have a think.