Audit everything coming from an ip adress in an Oracle database
With Unified Auditing.
Oracle Database Auditing

Oracle Database Unified Auditing enables selective and effective
auditing inside the Oracle database using policies and conditions. The
new policy based syntax simplifies management of auditing within the
database and provides the ability to accelerate auditing based on
conditions. For example, audit policies can be configured to audit
based on specific IP addresses, programs, time periods, or connection
types such as proxy authentication.

Example:
CREATE AUDIT POLICY mypolicy
ACTIONS ...
WHEN 'SYS_CONTEXT(''USERENV'', ''IP_ADDRESS'') = ''1.2.3.4'''
EVALUATE PER SESSION;