identifying new bots using alert intelligence?

Another way to look at this might be a daily or weekly report that shows a few metrics, by domain. Perhaps, application starts, unique visitor counts, time per visit, etc. Or maybe even better, some ratios of each of these. This will take a little more time to review on a regular basis. Alerts are good for overall issues or very significant issues, but may not catch smaller issues.

This is a really good use case for combining anomaly detection with IP-based tracking.

If you're already capturing IP addresses in eVar1, one option is to build a freeform table with Application Start as the metric and eVar1 (IP) as the dimension. Then enable Anomaly Detection on that metric, Adobe will flag unusual spikes or drops per IP, especially useful if a bot is hammering the site.

From there, you can create a custom alert to notify you via email if application starts spike above the expected threshold for any IP. You might want to narrow it to “top IPs” to avoid noise from low-volume outliers.

For the daily/weekly comparison, you could set up a calculated metric that shows % change (e.g., Current Day vs Previous Day, or Current Week vs Previous Week) for Application Start, this gives you a cleaner at-a-glance view for business teams.

If the list of suspicious IPs isn’t massive, you can also manually tag known bots with classification or a segment, that way, you can easily exclude them from standard reporting while still catching new ones with anomaly/alert logic.

Hope that helps!