Hello,
I have a hacker hitting our site. I can see him in our apache logs and we had an script which send him to a bad copy of our site in the F5. He's since caught on to this.
What he's doing now, it hits our site for 20minutes or so from one IP in a cloud provider, then that IP bleeds off and his script picks up from another IP another another cloud provider. This rotation continues endlessly all day every day.
I can see this visually very easy using timechart using this.
index=apache path=SOMEURI | timechart count by clientip usenull=f useother=f
Are there any functions in splunk/splunk es that can help catch this? So we can watch the sagging of one elipses and the starting of another and fire an alarm? Worth mentioning the cut over seems to be randomized. Sometimes a few minutes before the cut over and sometimes a few minutes after.
