DDoS protection
Understand always-on scrubbing, automatic activation, layer coverage, and attack recovery.
Guard mitigates network and application attacks on traffic admitted to its protected edge. Scrubbing remains in the traffic path; automatic mitigation changes the applicable attack controls when detection criteria are met.
Coverage and activation
Layer 3/4 protection evaluates network and transport traffic. Layer 7 protection evaluates supported application traffic, including HTTP controls where TLS termination permits inspection. Capacity, protocols, admitted prefixes, and services are recorded in Organization → Billing → Agreement → Protection coverage. Review that scope before onboarding high-volume services.
Automatic mitigation activation has a service target of under 60 seconds from detection for admitted protected traffic. This interval starts at Guard detection, not at an attacker sending their first packet or an origin becoming unreachable. It does not guarantee restoration of an already saturated upstream path or an unhealthy application.
Self-hosted installations need a healthy Connector and admitted edge route for DDoS mitigation. Local endpoint controls and scanning do not provide a substitute scrubbing path. Hosted services use the managed edge without deploying a customer Connector.
Operate an attack
Open Network protection → Attacks → Attack. Inspect start time, affected services, detection basis, active controls, accepted and dropped traffic, origin health, and capacity status. Notify the service owner and follow the DDoS runbook.
At Service → Protection policy, review automatic triggers and approved manual overrides. Use a bounded override with a reason and expiry. Tightening application controls can reject legitimate clients; compare successful transactions and origin latency as well as blocked request counts. Do not disable all protection to test one suspected false positive.
Recovery and limitations
When attack pressure falls, inspect the mitigation timeline and remaining overrides. Automatic transitions and manually pinned controls have separate status. Remove expired manual changes through Attack → Overrides and verify the adopted revision.
Always-on protection does not make direct-origin traffic protected. An alternate DNS record, leaked origin address, unsupported protocol, or unadvertised prefix can bypass coverage. Compare edge and origin observations when outages persist. Export a post-incident report with detection, activation, routing, and application recovery times kept separate.