Need a metric for suddenly rapid tablespace growing

Hi,

still I investigate further time for a solution maybe there is already one out there:

We have a tablespace with 1TB  and a occupation of 10percent. I've created a metric extension in EM Cloudcontrol, which monitors the usage of all tablespace including this.

At 80% of max possible occupancy it will create an incident for the DBA to  adds a datafile to the TS.

But im stil searching a metric which shows and alerts a suddenly high occupation over one hour, also a higher gradient of the occupation/input than normal.

This could happen if the aplication which used this tablespace is under a DOS attack or has a mal function, which generates thousends of MBytes Log into the DB (general a bad idea, but I have no influence to forbid that ).