mcpField
A
azure-ddos-protection

azure-ddos-protection

github.com/vinayaklattheSecurity17842 installsUpdated 19w ago
Repository

About azure-ddos-protection

azure-ddos-protection is a skill for planning Azure DDoS Protection against layer 3/4 attacks on public workloads. It helps cloud and security teams select coverage, configure monitoring, and prepare mitigation and incident workflows.

Key features

  1. 01按工作负载选择防护层级
  2. 02配置攻击指标与告警
  3. 03规划非生产环境模拟测试
  4. 04准备攻击分析与事后报告
  5. 05协调 DDoS 与 WAF 防护

Use cases

  1. 01为多区域公网 API 规划防护范围
  2. 02比较 Network Protection 与 IP Protection
  3. 03制定包含 Rapid Response 的攻击响应流程
  4. 04验证模拟测试和运行手册

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/vinayaklatthe/microsoft-security-skills --skill azure-ddos-protection

After installing, type/azure-ddos-protectionin Claude Code to confirm it loaded.

Details

From the project README

Azure DDoS Protection

Azure DDoS Protection sits on the Microsoft global network and absorbs layer 3/4 volumetric and protocol attacks before they reach your workloads. The free Infrastructure Protection layer protects Azure as a platform; the paid DDoS Protection plans give you dedicated, profile-tuned mitigation, attack analytics, post-incident reports, cost protection, and Rapid Response support for your resources.

When to use

Public-facing workloads with a non-trivial cost-of-downtime: e-commerce, regulated financial APIs, multiplayer gaming, public-sector services, internet-facing AI APIs, streaming, and any campaign exposed to politically or commercially motivated DDoS.

Do not use this skill for application-layer (HTTP) attack mitigation alone (azure-waf), Azure Firewall design (azure-firewall), or third-party DDoS appliance patterns.

Tier selection

TierScopeBest for
Infrastructure ProtectionFree, platform-level, no SLA, no analyticsDefault for every workload
DDoS Network ProtectionPer VNet, all public IPs in scopeMulti-IP workloads, large estates
DDoS IP ProtectionPer public IP, granularSmall estates, cost-conscious, specific high-risk IP

Pricing model differs: Network Protection is a flat fee per plan covering many resources; IP Protection is per-IP. Estate size flips the economics — model both before choosing.

Approach

  1. Decide tier per workload.

    • 50+ public IPs across multiple VNets → Network Protection on the relevant VNets.
    • Specific internet-facing app on a single Standard public IP → IP Protection.
    • Mixed → both, scoped appropriately.

  2. Enable on the VNet (Network Protection) at deployment time. The platform begins traffic profiling immediately; it learns normal patterns over ~7 days and auto-tunes the per-IP mitigation policy. Mitigation accuracy improves the longer the profile runs.

  3. Static thresholds are not a thing, by design. Mitigation is adaptive. Don't architect on the assumption of a fixed Mbps cap.

  4. Configure alerts. DDoS metrics and alerts are first-class:

    • "Under DDoS attack or not" boolean per public IP.
    • Inbound packets dropped by DDoS Protection.
    • Inbound TCP/UDP packets to be triggered for DDoS. Wire to Sentinel via Log Analytics + activity-log alerts.

  5. Simulate before incident. BreakingPoint Cloud and Red Button are Microsoft- approved simulation partners. Simulate quarterly on non-prod public IPs to validate mitigation engagement and runbook execution.

  6. Attack analytics + post-incident reports. During and after an attack, the product produces a mitigation report with attack vectors, traffic volume, top sources, and mitigation actions — useful evidence for board/regulator communications.

  7. DDoS Rapid Response (DRR). Plan on Network Protection includes engagement with Microsoft's DDoS response team during active attacks. Pre-stage:

    • DRR contact info in your IR runbook.
    • Customer support contract type that allows DRR (usually Premier/Unified or Pro Direct) — verify.
    • Designated owner who is authorized to engage Microsoft.

  8. Cost protection. A successful DDoS attack can balloon scale-out costs (autoscaled App Service, additional bandwidth, CDN egress). Network Protection includes service- credit cost protection — file the claim post-incident with the mitigation report.

  9. Combine with WAF and Front Door. DDoS Protection covers L3/L4. L7 attacks (HTTP floods, slow loris, business-logic abuse) need WAF on Front Door / Application Gateway in front of your workload. Architect both.

Guardrails

  • Infrastructure Protection (free) is not nothing, but is not enough for high-value public workloads. No SLA, no analytics, no cost protection.
  • Don't enable Network Protection on a VNet with no internet-facing public IP. No effect, full price.
  • Mitigation needs profile time. A brand-new public IP enabled minutes before an attack benefits less than one with 7+ days of baseline.
  • WAF and DDoS are complementary, not substitutes. L7 attacks bypass L3/L4 mitigation entirely.
  • Test in non-prod, never live customer endpoints. Simulation partners only on approved IPs in approved windows.
  • Standard public IP only. Basic public IPs aren't supported for IP Protection (and Basic SKU is being retired).
  • CDN-fronted workloads are partially shielded by the CDN's own DDoS posture; still consider DDoS Protection on the origin.
  • Don't use Azure DDoS as your DR plan. Mitigation reduces impact; it does not guarantee zero impact.

Common anti-patterns

  • "Free Infrastructure Protection is enough" — until the first targeted attack, then no analytics, no Rapid Response, no cost protection, no audit evidence.
  • "IP Protection on 200 IPs" — bill larger than Network Protection plan would have been. Model the math.
  • "Activated DDoS Protection during the attack" — profile is empty; less effective. Always pre-enable.
  • "Skipped simulation, never tested runbook" — first real engagement is fumbled.
  • "DRR not pre-arranged" — incident response wastes 60 minutes finding the right Microsoft contract path.
  • "Architected without WAF in front" — L7 attacks succeed through L3/L4 mitigation.
  • "Customer support tier doesn't permit DRR" — surprise during incident.

Example prompts

  • Plan DDoS Protection coverage for a 6-region public-API estate with 80 public IPs.
  • Compare Network vs IP Protection cost for a tenant with 25 public IPs in 3 VNets.
  • Build the DDoS attack runbook including DRR engagement steps and stakeholder comms templates.
  • Quarterly DDoS simulation with BreakingPoint Cloud — scope, success criteria, rollback.
  • Wire DDoS metrics + alerts to Sentinel with detections for sustained mitigation events.
  • Architect Front Door + WAF + DDoS Network Protection for a regulated e-commerce workload.
  • File the cost protection claim after a 14-hour mitigated attack — what evidence and process.

Microsoft Learn

Comments

Markdown supported