azure-ddos-protection

Name: azure-ddos-protection
Author: vinayaklatthe

161stars34forks

How to install azure-ddos-protection?

vinayaklatthe/microsoft-security-skills/azure-ddos-protection

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-ddos-protection

Installs into the current project.

Summary

Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform. Covers tier selection vs free Basic infrastructure protection, scope (VNet vs single IP), traffic profiling and mitigation po

Files · 1

View on GitHub

SKILL.md

1	# Azure DDoS Protection
2
3	Azure DDoS Protection sits on the Microsoft global network and absorbs **layer 3/4
4	volumetric and protocol attacks** before they reach your workloads. The free
5	Infrastructure Protection layer protects Azure as a platform; the paid
6	DDoS Protection plans give you dedicated, profile-tuned mitigation, attack analytics,
7	post-incident reports, cost protection, and Rapid Response support for your resources.
8
9	## When to use
10	Public-facing workloads with a non-trivial cost-of-downtime: e-commerce, regulated
11	financial APIs, multiplayer gaming, public-sector services, internet-facing AI APIs,
12	streaming, and any campaign exposed to politically or commercially motivated DDoS.
13
14	Do not use this skill for application-layer (HTTP) attack mitigation alone
15	(`azure-waf`), Azure Firewall design (`azure-firewall`), or third-party DDoS appliance
16	patterns.
17
18	## Tier selection
19
20	\| Tier \| Scope \| Best for \|
21	\|---\|---\|---\|
22	\| Infrastructure Protection \| Free, platform-level, no SLA, no analytics \| Default for every workload \|
23	\| DDoS Network Protection \| Per VNet, all public IPs in scope \| Multi-IP workloads, large estates \|
24	\| DDoS IP Protection \| Per public IP, granular \| Small estates, cost-conscious, specific high-risk IP \|
25
26	Pricing model differs: Network Protection is a flat fee per plan covering many resources;
27	IP Protection is per-IP. Estate size flips the economics — model both before choosing.
28
29	## Approach
30
31	1. Decide tier per workload.
32	- 50+ public IPs across multiple VNets → Network Protection on the relevant VNets.
33	- Specific internet-facing app on a single Standard public IP → IP Protection.
34	- Mixed → both, scoped appropriately.
35
36	2. Enable on the VNet (Network Protection) at deployment time. The platform begins
37	traffic profiling immediately; it learns normal patterns over ~7 days and
38	auto-tunes the per-IP mitigation policy. Mitigation accuracy improves the longer the
39	profile runs.
40
41	3. Static thresholds are not a thing, by design. Mitigation is adaptive. Don't
42	architect on the assumption of a fixed Mbps cap.
43
44	4. Configure alerts. DDoS metrics and alerts are first-class:
45	- "Under DDoS attack or not" boolean per public IP.
46	- Inbound packets dropped by DDoS Protection.
47	- Inbound TCP/UDP packets to be triggered for DDoS.
48	Wire to Sentinel via Log Analytics + activity-log alerts.
49
50	5. Simulate before incident. BreakingPoint Cloud and Red Button are Microsoft-
51	approved simulation partners. Simulate quarterly on non-prod public IPs to validate
52	mitigation engagement and runbook execution.
53
54	6. Attack analytics + post-incident reports. During and after an attack, the
55	product produces a mitigation report with attack vectors, traffic volume, top
56	sources, and mitigation actions — useful evidence for board/regulator
57	communications.
58
59	7. DDoS Rapid Response (DRR). Plan on Network Protection includes engagement with
60	Microsoft's DDoS response team during active attacks. Pre-stage:
61	- DRR contact info in your IR runbook.
62	- Customer support contract type that allows DRR (usually Premier/Unified or
63	Pro Direct) — verify.
64	- Designated owner who is authorized to engage Microsoft.
65
66	8. Cost protection. A successful DDoS attack can balloon scale-out costs (autoscaled
67	App Service, additional bandwidth, CDN egress). Network Protection includes service-
68	credit cost protection — file the claim post-incident with the mitigation report.
69
70	9. Combine with WAF and Front Door. DDoS Protection covers L3/L4. L7 attacks (HTTP
71	floods, slow loris, business-logic abuse) need WAF on Front Door / Application
72	Gateway in front of your workload. Architect both.
73
74	## Guardrails
75	- **Infrastructure Protection (free) is not nothing, but is not enough for high-value
76	public workloads.** No SLA, no analytics, no cost protection.
77	- Don't enable Network Protection on a VNet with no internet-facing public IP. No
78	effec

People who liked this also viewed

6 picks

Type

azure-ddos-protection

161stars34forks

View on GitHub

How to install azure-ddos-protection?

vinayaklatthe/microsoft-security-skills/azure-ddos-protection

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-ddos-protection

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure DDoS Protection
2
3	Azure DDoS Protection sits on the Microsoft global network and absorbs **layer 3/4
4	volumetric and protocol attacks** before they reach your workloads. The free
5	Infrastructure Protection layer protects Azure as a platform; the paid
6	DDoS Protection plans give you dedicated, profile-tuned mitigation, attack analytics,
7	post-incident reports, cost protection, and Rapid Response support for your resources.
8
9	## When to use
10	Public-facing workloads with a non-trivial cost-of-downtime: e-commerce, regulated
11	financial APIs, multiplayer gaming, public-sector services, internet-facing AI APIs,
12	streaming, and any campaign exposed to politically or commercially motivated DDoS.
13
14	Do not use this skill for application-layer (HTTP) attack mitigation alone
15	(`azure-waf`), Azure Firewall design (`azure-firewall`), or third-party DDoS appliance
16	patterns.
17
18	## Tier selection
19
20	\| Tier \| Scope \| Best for \|
21	\|---\|---\|---\|
22	\| Infrastructure Protection \| Free, platform-level, no SLA, no analytics \| Default for every workload \|
23	\| DDoS Network Protection \| Per VNet, all public IPs in scope \| Multi-IP workloads, large estates \|
24	\| DDoS IP Protection \| Per public IP, granular \| Small estates, cost-conscious, specific high-risk IP \|
25
26	Pricing model differs: Network Protection is a flat fee per plan covering many resources;
27	IP Protection is per-IP. Estate size flips the economics — model both before choosing.
28
29	## Approach
30
31	1. Decide tier per workload.
32	- 50+ public IPs across multiple VNets → Network Protection on the relevant VNets.
33	- Specific internet-facing app on a single Standard public IP → IP Protection.
34	- Mixed → both, scoped appropriately.
35
36	2. Enable on the VNet (Network Protection) at deployment time. The platform begins
37	traffic profiling immediately; it learns normal patterns over ~7 days and
38	auto-tunes the per-IP mitigation policy. Mitigation accuracy improves the longer the
39	profile runs.
40
41	3. Static thresholds are not a thing, by design. Mitigation is adaptive. Don't
42	architect on the assumption of a fixed Mbps cap.
43
44	4. Configure alerts. DDoS metrics and alerts are first-class:
45	- "Under DDoS attack or not" boolean per public IP.
46	- Inbound packets dropped by DDoS Protection.
47	- Inbound TCP/UDP packets to be triggered for DDoS.
48	Wire to Sentinel via Log Analytics + activity-log alerts.
49
50	5. Simulate before incident. BreakingPoint Cloud and Red Button are Microsoft-
51	approved simulation partners. Simulate quarterly on non-prod public IPs to validate
52	mitigation engagement and runbook execution.
53
54	6. Attack analytics + post-incident reports. During and after an attack, the
55	product produces a mitigation report with attack vectors, traffic volume, top
56	sources, and mitigation actions — useful evidence for board/regulator
57	communications.
58
59	7. DDoS Rapid Response (DRR). Plan on Network Protection includes engagement with
60	Microsoft's DDoS response team during active attacks. Pre-stage:
61	- DRR contact info in your IR runbook.
62	- Customer support contract type that allows DRR (usually Premier/Unified or
63	Pro Direct) — verify.
64	- Designated owner who is authorized to engage Microsoft.
65
66	8. Cost protection. A successful DDoS attack can balloon scale-out costs (autoscaled
67	App Service, additional bandwidth, CDN egress). Network Protection includes service-
68	credit cost protection — file the claim post-incident with the mitigation report.
69
70	9. Combine with WAF and Front Door. DDoS Protection covers L3/L4. L7 attacks (HTTP
71	floods, slow loris, business-logic abuse) need WAF on Front Door / Application
72	Gateway in front of your workload. Architect both.
73
74	## Guardrails
75	- **Infrastructure Protection (free) is not nothing, but is not enough for high-value
76	public workloads.** No SLA, no analytics, no cost protection.
77	- Don't enable Network Protection on a VNet with no internet-facing public IP. No
78	effec

People who liked this also viewed

6 picks

Type