What is a bot?¶

It is a device, account or process acting automatically from configuration or remote tasking, for legitimate or malicious purposes.

One instruction can create many events¶

Spam, scanning, login attempts, denial of service, downloads, theft and fraud may repeat on a schedule or command. Preserve process/config, regular communications, tasking commands, completed tasks and command infrastructure. Compare timing and config across devices to find common control without counting each action as a new human decision.

Separate owner, compromised device and operator¶

Monitoring and service automation may be authorised; a malicious bot may use an owner's device without their knowledge. Shared tasking supports a common mechanism but not direct personal control of every node. Identify who configured, commanded or benefited from automation through independent infrastructure and account evidence.