identifying new bots using alert intelligence?

[twinkleworld]

Hi,

I am still trying to visualise and heading around myself how we can identify new bots using alert? We have dedicated variable called eVar1 to capture the IP address details.

Business would like to know if there any abnormalities occurred for application start event. In everyday life, business or data analyst difficult to spend time for analysis the data whether those ip’s are real or bots. Instead business would like to get an alert on by email if any new bots triggered, so that analyst or business and go back to check the data what’s going on with particular IPs and then apply gatekeeper to stop fake numbers. We have an assumptions for daily/weekly numbers by average.

addition to that would like to report Current week vs previous week // current day vs previous day where to see whether application start numbers inflated compare to previous day or week.

Any inputs how we can address this

[ButhpurKiran · Accepted solution]

Adobe docs provides detailed information on creating alerts and anomaly detection in Adobe Analytics, refer to the official documentation:
https://experienceleague.adobe.com/en/docs/analytics/components/alerts/alert-builder 
https://experienceleague.adobe.com/en/docs/analytics/analyze/analysis-workspace/anomaly-detection/an... 

Thanks

Kiran Buthpur

[twinkleworld]

Yes, trying to address business questions, I am quite familiar with alerts and anomaly detection in AA. thanks for sharing the link.

[Josh__Stephens]

Another way to look at this might be a daily or weekly report that shows a few metrics, by domain. Perhaps, application starts, unique visitor counts, time per visit, etc. Or maybe even better, some ratios of each of these. This will take a little more time to review on a regular basis. Alerts are good for overall issues or very significant issues, but may not catch smaller issues.

[Vinay_Chauhan]

This is a really good use case for combining anomaly detection with IP-based tracking.

If you're already capturing IP addresses in eVar1, one option is to build a freeform table with Application Start as the metric and eVar1 (IP) as the dimension. Then enable Anomaly Detection on that metric, Adobe will flag unusual spikes or drops per IP, especially useful if a bot is hammering the site.

From there, you can create a custom alert to notify you via email if application starts spike above the expected threshold for any IP. You might want to narrow it to “top IPs” to avoid noise from low-volume outliers.

For the daily/weekly comparison, you could set up a calculated metric that shows % change (e.g., Current Day vs Previous Day, or Current Week vs Previous Week) for Application Start, this gives you a cleaner at-a-glance view for business teams.

If the list of suspicious IPs isn’t massive, you can also manually tag known bots with classification or a segment, that way, you can easily exclude them from standard reporting while still catching new ones with anomaly/alert logic.

Hope that helps!