It recently came to my attention (through an outside company) that a host on my internal LAN may be conducting web scraping activity against that outside company's web servers. Due to this activity, the outside company has blocked our ability to access any web server they host.
Anyone have any recommendations for any tools or methods to track down any endpoints on my own internal network that are conducting web scraping against external web sites? We recently purchased a SIEM solution, however it's not yet online, so my only other option is to manually review netflows for excessive http(s) against this company's hosts. Needless to say I'd much rather find a more expeditious option.
I have ~1200 endpoints on my internal LAN.