Ha, yup. We had metrics for any endpoint that was attempted and we got paged for zounds of 404s being generated. We thought it was an attack and reached out to

Ha, yup. We had metrics for any endpoint that was attempted and we got paged for zounds of 404s being generated. We thought it was an attack and reached out to our infosec team. "We are scanning for vulnerabilities." They wouldn't stop the scans so we had to stop alerting on 404 spikes. After, we have no way to detect an actual nefarious scan. Yay checkbox driven compliance.