The most important things for this are: - A good idea of what is normal traffic and behaviour on the web service. - Good threat intel. These 2 combined will ma

The most important things for this are: - A good idea of what is normal traffic and behaviour on the web service. - Good threat intel. These 2 combined will make it fairly obvious what needs to be done, but obtaining these 2 items is not a trivial task, infact, they are both continuous processes.