agentleFS
Sign inStart free
vinayaklatthevinayaklatthe/microsoft-security-skills/skills/azure-ddos-protection/SKILL.md

azure-ddos-protection

Skill179 starsChanged 5 months agoMITView on GitHub

Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform. Covers tier selection vs free Basic infrastructure protection, scope (VNet vs single IP), traffic profiling and mitigation policy auto-tuning, attack analytics and metrics, attack alerts to Sentinel, DDoS Rapid Response engagement, integration with Azure WAF and Front Door, cost-protection guarantee, mitigation reports for compliance, and per-region capacity planning. WHEN: Azure DDoS Protection, DDoS Network Protection, DDoS IP Protection, layer 3/4 DDoS, attack analytics Azure, DDoS rapid response, cost protection DDoS, DDoS metrics, mitigation report, simulate DDoS Azure. DO NOT USE for layer 7 / app-layer attack mitigation alone (use azure-waf), Azure Firewall design (use azure-firewall), or hybrid network DDoS via on-prem appliances.

Create a free account to mount
Files
SKILL.md

Azure DDoS Protection

Azure DDoS Protection sits on the Microsoft global network and absorbs layer 3/4 volumetric and protocol attacks before they reach your workloads. The free Infrastructure Protection layer protects Azure as a platform; the paid DDoS Protection plans give you dedicated, profile-tuned mitigation, attack analytics, post-incident reports, cost protection, and Rapid Response support for your resources.

When to use

Public-facing workloads with a non-trivial cost-of-downtime: e-commerce, regulated financial APIs, multiplayer gaming, public-sector services, internet-facing AI APIs, streaming, and any campaign exposed to politically or commercially motivated DDoS.

Do not use this skill for application-layer (HTTP) attack mitigation alone (azure-waf), Azure Firewall design (azure-firewall), or third-party DDoS appliance patterns.

Tier selection

TierScopeBest for
Infrastructure ProtectionFree, platform-level, no SLA, no analyticsDefault for every workload
DDoS Network ProtectionPer VNet, all public IPs in scopeMulti-IP workloads, large estates
DDoS IP ProtectionPer public IP, granularSmall estates, cost-conscious, specific high-risk IP

Pricing model differs: Network Protection is a flat fee per plan covering many resources; IP Protection is per-IP. Estate size flips the economics — model both before choosing.

Approach

  1. Decide tier per workload.
    • 50+ public IPs across multiple VNets → Network Protection on the relevant VNets.
    • Specific internet-facing app on a single Standard public IP → IP Protection.
    • Mixed → both, scoped appropriately.
  2. Enable on the VNet (Network Protection) at deployment time. The platform begins traffic profiling immediately; it learns normal patterns over ~7 days and auto-tunes the per-IP mitigation policy. Mitigation accuracy improves the longer the profile runs.
  3. Static thresholds are not a thing, by design. Mitigation is adaptive. Don't architect on the assumption of a fixed Mbps cap.
  4. Configure alerts. DDoS metrics and alerts are first-class:
    • "Under DDoS attack or not" boolean per public IP.
    • Inbound packets dropped by DDoS Protection.
    • Inbound TCP/UDP packets to be triggered for DDoS. Wire to Sentinel via Log Analytics + activity-log alerts.
  5. Simulate before incident. BreakingPoint Cloud and Red Button are Microsoft- approved simulation partners. Simulate quarterly on non-prod public IPs to validate mitigation engagement and runbook execution.
  6. Attack analytics + post-incident reports. During and after an attack, the product produces a mitigation report with attack vectors, traffic volume, top sources, and mitigation actions — useful evidence for board/regulator communications.
  7. DDoS Rapid Response (DRR). Plan on Network Protection includes engagement with Microsoft's DDoS response team during active attacks. Pre-stage:
    • DRR contact info in your IR runbook.
    • Customer support contract type that allows DRR (usually Premier/Unified or Pro Direct) — verify.
    • Designated owner who is authorized to engage Microsoft.
  8. Cost protection. A successful DDoS attack can balloon scale-out costs (autoscaled App Service, additional bandwidth, CDN egress). Network Protection includes service- credit cost protection — file the claim post-incident with the mitigation report.
  9. Combine with WAF and Front Door. DDoS Protection covers L3/L4. L7 attacks (HTTP floods, slow loris, business-logic abuse) need WAF on Front Door / Application Gateway in front of your workload. Architect both.

Guardrails

  • Infrastructure Protection (free) is not nothing, but is not enough for high-value public workloads. No SLA, no analytics, no cost protection.
  • Don't enable Network Protection on a VNet with no internet-facing public IP. No effect, full price.
  • Mitigation needs profile time. A brand-new public IP enabled minutes before an attack benefits less than one with 7+ days of baseline.
  • WAF and DDoS are complementary, not substitutes. L7 attacks bypass L3/L4 mitigation entirely.
  • Test in non-prod, never live customer endpoints. Simulation partners only on approved IPs in approved windows.
  • Standard public IP only. Basic public IPs aren't supported for IP Protection (and Basic SKU is being retired).
  • CDN-fronted workloads are partially shielded by the CDN's own DDoS posture; still consider DDoS Protection on the origin.
  • Don't use Azure DDoS as your DR plan. Mitigation reduces impact; it does not guarantee zero impact.

Common anti-patterns

  • "Free Infrastructure Protection is enough" — until the first targeted attack, then no analytics, no Rapid Response, no cost protection, no audit evidence.
  • "IP Protection on 200 IPs" — bill larger than Network Protection plan would have been. Model the math.
  • "Activated DDoS Protection during the attack" — profile is empty; less effective. Always pre-enable.
  • "Skipped simulation, never tested runbook" — first real engagement is fumbled.
  • "DRR not pre-arranged" — incident response wastes 60 minutes finding the right Microsoft contract path.
  • "Architected without WAF in front" — L7 attacks succeed through L3/L4 mitigation.
  • "Customer support tier doesn't permit DRR" — surprise during incident.

Example prompts

  • Plan DDoS Protection coverage for a 6-region public-API estate with 80 public IPs.
  • Compare Network vs IP Protection cost for a tenant with 25 public IPs in 3 VNets.
  • Build the DDoS attack runbook including DRR engagement steps and stakeholder comms templates.
  • Quarterly DDoS simulation with BreakingPoint Cloud — scope, success criteria, rollback.
  • Wire DDoS metrics + alerts to Sentinel with detections for sustained mitigation events.
  • Architect Front Door + WAF + DDoS Network Protection for a regulated e-commerce workload.
  • File the cost protection claim after a 14-hour mitigated attack — what evidence and process.

Microsoft Learn

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free