russians not employees are on my internal network sniffing around

sometimes you just want to know who looks at your internal site. you know, those ones behind the dmz. places like that. you use google analytics because it is nice.
then all of a sudden you notice hits from places like mozambique and st. lucia and russia, you get this feeling in your stomach that bad things have happened. really bad things
well. the google id you're provided with can be easily guessed. and that's what spammers do. they run through google ids to boost their sites. and it so happens that's what they're doing with your id. no worries. to figure out who really accesses your site, set up some custom ga code and a cookie.

use cookies for tracking:

google analytics
admin

property > Dd Custom Definitions | Custom Dimensions
+New Custom Dimension

Name: sitename-cookie
Scope: User
Active: checked

after creation:
My index is 1

var dimensionValue = 'SOME_DIMENSION_VALUE';
ga('set', 'dimension1', dimensionValue);

in my case:

SOME_DIMENSION_VALUE = sitename-cookie 
dimension1 = tasty-cookie


insert the following in java scriptlet:

var dimensionValue = 'sitename-cookie';
ga('set', 'tasty-cookie', dimensionValue);

google tag manager
https://www.google.com/tagmanager/
account sitename
container sitename
where to use: web pages
tags: google analytics

tag name: sitename-cookie
tag type: universal
tracking id: UA-XXXXXXXX-1 (google analytics id)

more settings | cookie configuration
cookie name sitename-cookie

more settings | custom dimensions
index 1
dimension value sitename-cookie

firing rules: all pages

create & publish

place gtm cookie as directed by google.

google analytics
admin

Filter | create new
Filer name sitename-cookie
include
Filter field sitename-cookie (custom)