An administrator believes that the web servers are being flooded with excessive traffic from time to time. The administrator suspects that these traffic floods correspond to when a competitor makes…

Data analytics allows the administrator to ingest web traffic logs and compare traffic spike timestamps against a timeline of publicly recorded competitor announcements, revealing whether a statistically significant pattern exists. This approach provides reproducible, evidence-based proof of correlation rather than anecdotal observation. It transforms raw log data and external event data into actionable intelligence about attack timing.

A honeypot captures attacker tools and techniques during an intrusion but does not provide timing correlation between external events and attack frequency.

Configuring high availability addresses service resilience during floods but does nothing to investigate or prove the source or timing pattern of the traffic.

Logging competitor IP addresses assumes the floods originate directly from the competitor, which is unverified - volumetric attacks typically use distributed botnets, not identifiable source IPs.