Alert if the same IP visits more than 20 times in an hour

[drussell88]

I am trying to create a search string to determine if any IP comes up more than 20 times in an hour.

[Ledion_Bitincka]

You should be able to create an alert by setting

Alert's search: .... | stats count by ip | search count>20

Alert's condition: number of results > 0

Alert's scheduler: hourly