Skip to content

Commit 9a5d13d

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #215141 from AbdullahBell/MonitoringMetrics
DDoS Protection: New Monitoring Concept article
2 parents 7e28beb + cd123b2 commit 9a5d13d

File tree

5 files changed

+147
-106
lines changed

5 files changed

+147
-106
lines changed

‎articles/azure-monitor/essentials/resource-logs-schema.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ The schema for resource logs varies depending on the resource and log category.
6868
| Azure Database for MySQL | [Azure Database for MySQL diagnostic logs](../../mysql/concepts-server-logs.md#diagnostic-logs) |
6969
| Azure Database for PostgreSQL | [Azure Database for PostgreSQL logs](../../postgresql/concepts-server-logs.md#resource-logs) |
7070
| Azure Databricks | [Diagnostic logging in Azure Databricks](/azure/databricks/administration-guide/account-settings/azure-diagnostic-logs) |
71-
| Azure DDoS Protection | [Logging for Azure DDoS Protection](../../ddos-protection/diagnostic-logging.md#log-schemas) |
71+
| Azure DDoS Protection | [Logging for Azure DDoS Protection](../../ddos-protection/monitor-ddos-protection-reference.md#log-schemas) |
7272
| Azure Digital Twins | [Set up Azure Digital Twins diagnostics](../../digital-twins/troubleshoot-diagnostics.md#log-schemas)
7373
| Azure Event Hubs |[Azure Event Hubs logs](../../event-hubs/event-hubs-diagnostic-logs.md) |
7474
| Azure ExpressRoute | [Monitoring Azure ExpressRoute](../../expressroute/monitor-expressroute.md#collection-and-routing) |

‎articles/ddos-protection/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@
5454
href: ddos-disaster-recovery-guidance.md
5555
- name: Security baseline
5656
href: /security/benchmark/azure/baselines/azure-ddos-protection-security-baseline?toc=%2fazure%2fddos-protection%2ftoc.json?toc=/azure/ddos-protection/TOC.json
57+
- name: Monitoring Azure DDoS Protection
58+
href: monitor-ddos-protection-reference.md
5759
- name: How-to guides
5860
items:
5961
- name: Test with simulation partners

‎articles/ddos-protection/diagnostic-logging.md

Lines changed: 1 addition & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ If you want to automatically enable diagnostic logging on all public IPs within
5959

6060
### Query Azure DDOS Protection logs in log analytics workspace
6161

62+
For more information on log schemas, see [Monitoring Azure DDoS Protection](monitor-ddos-protection-reference.md#diagnostic-logs).
6263
#### DDoSProtectionNotifications logs
6364

6465
1. Under the **Log analytics workspaces** blade, select your log analytics workspace.
@@ -86,71 +87,6 @@ If you want to automatically enable diagnostic logging on all public IPs within
8687
| where Category == "DDoSMitigationReports"
8788
```
8889
89-
### Log schemas
90-
91-
The following table lists the field names and descriptions:
92-
93-
# [DDoSProtectionNotifications](#tab/DDoSProtectionNotifications)
94-
95-
| Field name | Description |
96-
| --- | --- |
97-
| **TimeGenerated** | The date and time in UTC when the notification was created. |
98-
| **ResourceId** | The resource ID of your public IP address. |
99-
| **Category** | For notifications, this will be `DDoSProtectionNotifications`.|
100-
| **ResourceGroup** | The resource group that contains your public IP address and virtual network. |
101-
| **SubscriptionId** | Your DDoS protection plan subscription ID. |
102-
| **Resource** | The name of your public IP address. |
103-
| **ResourceType** | This will always be `PUBLICIPADDRESS`. |
104-
| **OperationName** | For notifications, this will be `DDoSProtectionNotifications`. |
105-
| **Message** | Details of the attack. |
106-
| **Type** | Type of notification. Possible values include `MitigationStarted`. `MitigationStopped`. |
107-
| **PublicIpAddress** | Your public IP address. |
108-
109-
# [DDoSMitigationFlowLogs](#tab/DDoSMitigationFlowLogs)
110-
111-
| Field name | Description |
112-
| --- | --- |
113-
| **TimeGenerated** | The date and time in UTC when the flow log was created. |
114-
| **ResourceId** | The resource ID of your public IP address. |
115-
| **Category** | For flow logs, this will be `DDoSMitigationFlowLogs`.|
116-
| **ResourceGroup** | The resource group that contains your public IP address and virtual network. |
117-
| **SubscriptionId** | Your DDoS protection plan subscription ID. |
118-
| **Resource** | The name of your public IP address. |
119-
| **ResourceType** | This will always be `PUBLICIPADDRESS`. |
120-
| **OperationName** | For flow logs, this will be `DDoSMitigationFlowLogs`. |
121-
| **Message** | Details of the attack. |
122-
| **SourcePublicIpAddress** | The public IP address of the client generating traffic to your public IP address. |
123-
| **SourcePort** | Port number ranging from 0 to 65535. |
124-
| **DestPublicIpAddress** | Your public IP address. |
125-
| **DestPort** | Port number ranging from 0 to 65535. |
126-
| **Protocol** | Type of protocol. Possible values include `tcp`, `udp`, `other`.|
127-
128-
# [DDoSMitigationReports](#tab/DDoSMitigationReports)
129-
130-
| Field name | Description |
131-
| --- | --- |
132-
| **TimeGenerated** | The date and time in UTC when the report was created. |
133-
| **ResourceId** | The resource ID of your public IP address. |
134-
| **Category** | For notifications, this will be `DDoSMitigationReports`.|
135-
| **ResourceGroup** | The resource group that contains your public IP address and virtual network. |
136-
| **SubscriptionId** | Your DDoS protection plan subscription ID. |
137-
| **Resource** | The name of your public IP address. |
138-
| **ResourceType** | This will always be `PUBLICIPADDRESS`. |
139-
| **OperationName** | For mitigation reports, this will be `DDoSMitigationReports`. |
140-
| **ReportType** | Possible values include `Incremental`, `PostMitigation`.|
141-
| **MitigationPeriodStart** | The date and time in UTC when the mitigation started. |
142-
| **MitigationPeriodEnd** | The date and time in UTC when the mitigation ended. |
143-
| **IPAddress** | Your public IP address. |
144-
| **AttackVectors** | Breakdown of attack types. Keys include `TCP SYN flood`, `TCP flood`, `UDP flood`, `UDP reflection`, `Other packet flood`.|
145-
| **TrafficOverview** | Breakdown of attack traffic. Keys include `Total packets`, `Total packets dropped`, `Total TCP packets`, `Total TCP packets dropped`, `Total UDP packets`, `Total UDP packets dropped`, `Total Other packets`, `Total Other packets dropped`. |
146-
| **Protocols** | Breakdown of protocols involved. Keys include `TCP`, `UDP`, `Other`. |
147-
| **DropReasons** | Breakdown of reasons for dropped packets. Keys include `Protocol violation invalid TCP syn`, `Protocol violation invalid TCP`, `Protocol violation invalid UDP`, `UDP reflection`, `TCP rate limit exceeded`, `UDP rate limit exceeded`, `Destination limit exceeded`, `Other packet flood`, `Rate limit exceeded`, `Packet was forwarded to service`. |
148-
| **TopSourceCountries** | Breakdown of top 10 source countries of incoming traffic. |
149-
| **TopSourceCountriesForDroppedPackets** | Breakdown of top 10 source countries of attack traffic that is/was mitigated. |
150-
| **TopSourceASNs** | Breakdown of top 10 source autonomous system numbers (ASN) of the incoming traffic. |
151-
| **SourceContinents** | Breakdown of the source continents of incoming traffic. |
152-
***
153-
15490
## Enable diagnostic logging on all public IPs
15591
15692
This [built-in policy](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F752154a7-1e0f-45c6-a880-ac75a7e4f648) automatically enables diagnostic logging on all public IP logs in a defined scope. See [Azure Policy built-in definitions for Azure DDoS Protection](policy-reference.md) for full list of built-in policies.

‎articles/ddos-protection/monitor-ddos-protection-reference.md

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
---
2+
title: 'Monitoring Azure DDoS Protection'
3+
description: Important reference material needed when you monitor DDoS Protection
4+
author: AbdullahBell
5+
ms.author: abell
6+
ms.service: ddos-protection
7+
ms.topic: conceptual
8+
ms.date: 12/1/2022
9+
ms.custom: template-concept
10+
---
11+
12+
# Monitoring Azure DDoS Protection
13+
14+
15+
See [Tutorial: View and configure Azure DDoS protection telemetry](telemetry.md) for details on collecting, analyzing, and monitoring DDoS Protection.
16+
17+
## Metrics
18+
19+
20+
21+
### DDoS protection metrics
22+
23+
The metric names present different packet types, and bytes vs. packets, with a basic construct of tag names on each metric as follows:
24+
25+
* **Dropped tag name** (for example, **Inbound Packets Dropped DDoS**): The number of packets dropped/scrubbed by the DDoS protection system.
26+
27+
* **Forwarded tag name** (for example **Inbound Packets Forwarded DDoS**): The number of packets forwarded by the DDoS system to the destination VIP – traffic that wasn't filtered.
28+
29+
* **No tag name** (for example **Inbound Packets DDoS**): The total number of packets that came into the scrubbing system – representing the sum of the packets dropped and forwarded.
30+
31+
> [!NOTE]
32+
> While multiple options for **Aggregation** are displayed on Azure portal, only the aggregation types listed in the table below are supported for each metric. We apologize for this confusion and we are working to resolve it.
33+
The following [Azure Monitor metrics](../azure-monitor/essentials/metrics-supported.md#microsoftnetworkpublicipaddresses) are available for Azure DDoS Protection. These metrics are also exportable via diagnostic settings, see [View and configure DDoS diagnostic logging](diagnostic-logging.md).
34+
35+
| Metric | Metric Display Name | Unit | Aggregation Type | Description |
36+
| --- | --- | --- | --- | --- |
37+
| BytesDroppedDDoS​ | Inbound bytes dropped DDoS​ | BytesPerSecond​ | Maximum​ | Inbound bytes dropped DDoS​|
38+
| BytesForwardedDDoS​ | Inbound bytes forwarded DDoS​ | BytesPerSecond​ | Maximum​ | Inbound bytes forwarded DDoS​ |
39+
| BytesInDDoS​ | Inbound bytes DDoS​ | BytesPerSecond​ | Maximum​ | Inbound bytes DDoS​ |
40+
| DDoSTriggerSYNPackets​ | Inbound SYN packets to trigger DDoS mitigation​ | CountPerSecond​ | Maximum​ | Inbound SYN packets to trigger DDoS mitigation​ |
41+
| DDoSTriggerTCPPackets​ | Inbound TCP packets to trigger DDoS mitigation​ | CountPerSecond​ | Maximum​ | Inbound TCP packets to trigger DDoS mitigation​ |
42+
| DDoSTriggerUDPPackets​ | Inbound UDP packets to trigger DDoS mitigation​ | CountPerSecond​ | Maximum​ | Inbound UDP packets to trigger DDoS mitigation​ |
43+
| IfUnderDDoSAttack​ | Under DDoS attack or not​ | Count​ | Maximum​ | Under DDoS attack or not​ |
44+
| PacketsDroppedDDoS​ | Inbound packets dropped DDoS​ | CountPerSecond​ | Maximum​ | Inbound packets dropped DDoS​ |
45+
| PacketsForwardedDDoS​ | Inbound packets forwarded DDoS​ | CountPerSecond​ | Maximum​ | Inbound packets forwarded DDoS​ |
46+
| PacketsInDDoS​ | Inbound packets DDoS​ | CountPerSecond​ | Maximum​ | Inbound packets DDoS​ |
47+
| TCPBytesDroppedDDoS​ | Inbound TCP bytes dropped DDoS​ | BytesPerSecond​ | Maximum​ | Inbound TCP bytes dropped DDoS​ |
48+
| TCPBytesForwardedDDoS​ | Inbound TCP bytes forwarded DDoS​ | BytesPerSecond​ | Maximum​ | Inbound TCP bytes forwarded DDoS​ |
49+
| TCPBytesInDDoS​ | Inbound TCP bytes DDoS​ | BytesPerSecond​ | Maximum​ | Inbound TCP bytes DDoS​ |
50+
| TCPPacketsDroppedDDoS​ | Inbound TCP packets dropped DDoS​ | CountPerSecond​ | Maximum​ | Inbound TCP packets dropped DDoS​ |
51+
| TCPPacketsForwardedDDoS​ | Inbound TCP packets forwarded DDoS​ | CountPerSecond​ | Maximum​ | Inbound TCP packets forwarded DDoS​ |
52+
| TCPPacketsInDDoS​ | Inbound TCP packets DDoS​ | CountPerSecond​ | Maximum​ | Inbound TCP packets DDoS​ |
53+
| UDPBytesDroppedDDoS​ | Inbound UDP bytes dropped DDoS​ | BytesPerSecond​ | Maximum​ | Inbound UDP bytes dropped DDoS​ |
54+
| UDPBytesForwardedDDoS​ | Inbound UDP bytes forwarded DDoS​ | BytesPerSecond​ | Maximum​ | Inbound UDP bytes forwarded DDoS​ |
55+
| UDPBytesInDDoS​ | Inbound UDP bytes DDoS​ | BytesPerSecond​ | Maximum​ | Inbound UDP bytes DDoS​ |
56+
| UDPPacketsDroppedDDoS​ | Inbound UDP packets dropped DDoS​ | CountPerSecond​ | Maximum​ | Inbound UDP packets dropped DDoS​ |
57+
| UDPPacketsForwardedDDoS​ | Inbound UDP packets forwarded DDoS​ | CountPerSecond​ | Maximum​ | Inbound UDP packets forwarded DDoS​ |
58+
| UDPPacketsInDDoS​ | Inbound UDP packets DDoS​ | CountPerSecond​ | Maximum​ | Inbound UDP packets DDoS​ |
59+
### Diagnostic logs
60+
61+
See [Tutorial: View and configure Azure DDoS Protection diagnostic logging](diagnostic-logging.md) for details on attack insights and visualization with DDoS Attack Analytics.
62+
63+
The following diagnostic logs are available for Azure DDoS Protection:
64+
65+
- **DDoSProtectionNotifications**: Notifications will notify you anytime a public IP resource is under attack, and when attack mitigation is over.
66+
- **DDoSMitigationFlowLogs**: Attack mitigation flow logs allow you to review the dropped traffic, forwarded traffic and other interesting data-points during an active DDoS attack in near-real time. You can ingest the constant stream of this data into Microsoft Sentinel or to your third-party SIEM systems via event hub for near-real time monitoring, take potential actions and address the need of your defense operations.
67+
- **DDoSMitigationReports**: Attack mitigation reports use the Netflow protocol data, which is aggregated to provide detailed information about the attack on your resource. Anytime a public IP resource is under attack, the report generation will start as soon as the mitigation starts. There will be an incremental report generated every 5 mins and a post-mitigation report for the whole mitigation period. This is to ensure that in an event the DDoS attack continues for a longer duration of time, you'll be able to view the most current snapshot of mitigation report every 5 minutes and a complete summary once the attack mitigation is over.
68+
- **AllMetrics**: Provides all possible metrics available during the duration of a DDoS attack.
69+
70+
### Log schemas
71+
72+
The following table lists the field names and descriptions:
73+
74+
# [DDoSProtectionNotifications](#tab/DDoSProtectionNotifications)
75+
76+
| Field name | Description |
77+
| --- | --- |
78+
| **TimeGenerated** | The date and time in UTC when the notification was created. |
79+
| **ResourceId** | The resource ID of your public IP address. |
80+
| **Category** | For notifications, this will be `DDoSProtectionNotifications`.|
81+
| **ResourceGroup** | The resource group that contains your public IP address and virtual network. |
82+
| **SubscriptionId** | Your DDoS protection plan subscription ID. |
83+
| **Resource** | The name of your public IP address. |
84+
| **ResourceType** | This will always be `PUBLICIPADDRESS`. |
85+
| **OperationName** | For notifications, this will be `DDoSProtectionNotifications`. |
86+
| **Message** | Details of the attack. |
87+
| **Type** | Type of notification. Possible values include `MitigationStarted`. `MitigationStopped`. |
88+
| **PublicIpAddress** | Your public IP address. |
89+
90+
# [DDoSMitigationFlowLogs](#tab/DDoSMitigationFlowLogs)
91+
92+
| Field name | Description |
93+
| --- | --- |
94+
| **TimeGenerated** | The date and time in UTC when the flow log was created. |
95+
| **ResourceId** | The resource ID of your public IP address. |
96+
| **Category** | For flow logs, this will be `DDoSMitigationFlowLogs`.|
97+
| **ResourceGroup** | The resource group that contains your public IP address and virtual network. |
98+
| **SubscriptionId** | Your DDoS protection plan subscription ID. |
99+
| **Resource** | The name of your public IP address. |
100+
| **ResourceType** | This will always be `PUBLICIPADDRESS`. |
101+
| **OperationName** | For flow logs, this will be `DDoSMitigationFlowLogs`. |
102+
| **Message** | Details of the attack. |
103+
| **SourcePublicIpAddress** | The public IP address of the client generating traffic to your public IP address. |
104+
| **SourcePort** | Port number ranging from 0 to 65535. |
105+
| **DestPublicIpAddress** | Your public IP address. |
106+
| **DestPort** | Port number ranging from 0 to 65535. |
107+
| **Protocol** | Type of protocol. Possible values include `tcp`, `udp`, `other`.|
108+
109+
# [DDoSMitigationReports](#tab/DDoSMitigationReports)
110+
111+
| Field name | Description |
112+
| --- | --- |
113+
| **TimeGenerated** | The date and time in UTC when the report was created. |
114+
| **ResourceId** | The resource ID of your public IP address. |
115+
| **Category** | For notifications, this will be `DDoSMitigationReports`.|
116+
| **ResourceGroup** | The resource group that contains your public IP address and virtual network. |
117+
| **SubscriptionId** | Your DDoS protection plan subscription ID. |
118+
| **Resource** | The name of your public IP address. |
119+
| **ResourceType** | This will always be `PUBLICIPADDRESS`. |
120+
| **OperationName** | For mitigation reports, this will be `DDoSMitigationReports`. |
121+
| **ReportType** | Possible values include `Incremental`, `PostMitigation`.|
122+
| **MitigationPeriodStart** | The date and time in UTC when the mitigation started. |
123+
| **MitigationPeriodEnd** | The date and time in UTC when the mitigation ended. |
124+
| **IPAddress** | Your public IP address. |
125+
| **AttackVectors** | Breakdown of attack types. Keys include `TCP SYN flood`, `TCP flood`, `UDP flood`, `UDP reflection`, `Other packet flood`.|
126+
| **TrafficOverview** | Breakdown of attack traffic. Keys include `Total packets`, `Total packets dropped`, `Total TCP packets`, `Total TCP packets dropped`, `Total UDP packets`, `Total UDP packets dropped`, `Total Other packets`, `Total Other packets dropped`. |
127+
| **Protocols** | Breakdown of protocols involved. Keys include `TCP`, `UDP`, `Other`. |
128+
| **DropReasons** | Breakdown of reasons for dropped packets. Keys include `Protocol violation invalid TCP syn`, `Protocol violation invalid TCP`, `Protocol violation invalid UDP`, `UDP reflection`, `TCP rate limit exceeded`, `UDP rate limit exceeded`, `Destination limit exceeded`, `Other packet flood`, `Rate limit exceeded`, `Packet was forwarded to service`. |
129+
| **TopSourceCountries** | Breakdown of top 10 source countries of incoming traffic. |
130+
| **TopSourceCountriesForDroppedPackets** | Breakdown of top 10 source countries of attack traffic that is/was mitigated. |
131+
| **TopSourceASNs** | Breakdown of top 10 source autonomous system numbers (ASN) of the incoming traffic. |
132+
| **SourceContinents** | Breakdown of the source continents of incoming traffic. |
133+
***
134+
135+
## Next steps
136+
137+
> [!div class="nextstepaction"]
138+
> [View and configure DDoS diagnostic logging](diagnostic-logging.md)
139+
>
140+
> [Test with simulation partners](test-through-simulations.md)
141+
142+

0 commit comments

Comments
 (0)