Is it possible to get individual IP address count from different sources to my server(packetbeat installed)

Elastic Stack Beats
1

I am using "packet beats" for my project which is related to DoS(Denial of service) attacks. Is it possible to make "packetbeat" to store unique ip addresses(from different sources) along with some parameters --> count on real time.Based on that detecting and alerting stuff.

2

You an use a cardinality aggregation in Elasticsearch to count the number of unique IP addresses.

3

thanks for quick reply Mr.Andrewkroh, I will go through :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.