Skip to content

[DDoS Protection] Flagged traffic clarification #20145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
patriciasantaana merged 6 commits into from
Mar 14, 2025
Merged

[DDoS Protection] Flagged traffic clarification #20145

Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e0c647f
flagged traffic
patriciasantaana Feb 20, 2025
6b78e25
Merge branch 'production' into patricia/pcx15685-managed-rulesets-fla…
patriciasantaana Mar 3, 2025
f0ca78f
fix wording
patriciasantaana Mar 3, 2025
b4e5e02
Update src/content/docs/ddos-protection/managed-rulesets/adaptive-pro…
patriciasantaana Mar 3, 2025
38cea43
Update src/content/docs/ddos-protection/managed-rulesets/adaptive-pro…
patriciasantaana Mar 14, 2025
876a47d
Update adaptive-protection.mdx
patriciasantaana Mar 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions src/content/docs/ddos-protection/managed-rulesets/adaptive-protection.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,6 @@ Adaptive DDoS Protection provides the following types of protection:

Cloudflare Adaptive DDoS Protection is available to Enterprise customers according to the following table:



| Feature | Profiling dimension | WAF/CDN<sup>1</sup> | Magic Transit /<br/>Spectrum BYOIP<sup>2</sup> |
| --------------------------------- | ------------------------------------------ | :-----------------: | :--------------------------------------------: |
| **HTTP Adaptive DDoS Protection** | | | |
Expand All @@ -32,8 +30,6 @@ Cloudflare Adaptive DDoS Protection is available to Enterprise customers accordi
| For Protocols | IP protocol | — | Yes |
| For Protocols | Client IP country and Region for UDP | — | Yes |



<sup>1</sup> _WAF/CDN customers on the Enterprise plan with the Advanced DDoS Protection subscription._<br/>
<sup>2</sup> _Magic Transit and Spectrum BYOIP customers on an Enterprise plan._

Expand Down Expand Up @@ -70,10 +66,17 @@ To view traffic flagged by L3/4 Adaptive DDoS Protection rules:

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
2. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
3. Filter by `Ruleset ID equals 3b64149bfa6e4220bbbc2bd6db589552` (the ID of the Network-layer DDoS Attack Protection managed ruleset) and by rule ID.
3. Filter by rule ID.

You may also obtain information about flagged traffic through [Logpush](/logs/about/) or the [GraphQL API](/analytics/graphql-api/).

To determine if it is safe to enable an adaptive rule in mitigation:

- If no packets match the rule (in the last 7 days or 24 hours), you should consider changing the rule from `log` to `block`.
- If packets do match the rule, verify that the traffic matches and decide if it is valid.

The default rule action for `log` with a sensitivity set to `high` will only show packets with suspected attack traffic over internal `high` thresholds in your logs. For instance, if you set the threshold to `medium` or `low`, then only packets over those thresholds will be logged.

## Configure the rules

You can adjust the action and sensitivity of the Adaptive DDoS Protection rules. The default action is _Log_. Use this action to first observe what traffic is flagged before deciding on a mitigation action.
Expand Down
Loading