Security Onion Elsa Alerts

[tgorman123]

I have Security Onion's ELSA all set up capturing IP addresses. The top 25-30 IP addresses should remain about the same. I would like to receive an alert if a new IP address appears in the top 25 or so via email or some sort. I was wondering if ESLA has this capability or if there is somewhere I can start to create a tool to do this. Thanks!