Utilizing Azure DDoS Protection Workbook for DDoS attack traffic Analysis

In today’s digital age, the security of applications, servers, and networks is paramount. One of the most critical threats to this security is Distributed Denial of Service (DDoS) attacks. These attacks can paralyze your infrastructure, resulting in downtime, loss of revenue, and reputational damage. Therefore, it is important to implement robust protection mechanisms to protect your digital assets.

Azure DDoS Protection provides a comprehensive solution to defend against these malicious attacks. It provides automatic attack detection and mitigation capabilities to ensure that applications and services remain available during attacks. Azure DDoS Protection is fully integrated with Azure’s foundational services, making it an ideal choice for enterprises already leveraging the Azure ecosystem. Key features of Azure DDoS Protection include adaptive tuning, attack analytics and metrics, and rapid DDoS response. By leveraging Azure DDoS Protection, enterprises can ensure the resiliency and availability of their digital infrastructure, providing peace of mind in an increasingly hostile cyber environment.

This blog focuses on how to use the Azure DDoS Workbook to understand the current DDoS attack situation within our environment.

Investigate DDoS Attack Environments Using the Azure DDoS Workbook

When a DDoS attack occurs, it is important to have the right tools to investigate and understand the impact of the attack. The Azure DDoS Workbook is an invaluable resource for this purpose. It provides detailed insights into DDoS attack traffic over a specific period of time in a single dashboard. For more information on deep investigation into a DDoS attack, check out the detailed steps mentioned. here.

Setting up the DDoS Workbook: Below are the steps needed to set up and use the DDoS Workbook effectively.

• Configuring diagnostic logging and metrics: Make sure that the diagnostic settings are enabled for the public IP addresses you want to monitor. This will allow you to collect the necessary DDoS mitigation flow logs, reports, and metrics as shown below.

• Access the Azure DDoS Workbook: Azure DDoS Workbook can be deployed by installing the Sentinel solution for Azure DDoS Protection as shown below or by using the deployment template in the Azure Network Security GitHub repository. It provides a comprehensive view of DDoS attack metrics and logs in a single dashboard.

1. Sentinel Solutions: Go to the Content Hub tab in Sentinel Blade and install the Azure DDoS Protection solution.

2. Net Sec GitHub Repository: Go to Net Sec GitHub Repository Deploy the workbook using the Azure Deploy button as shown below.

• Configuring the Azure DDoS Workbook: The Azure DDoS workbook should provide the Log Analytics Workspace, TimeRange, and Public IP resource details as shown below.

Analyze Workbook Details:

• Transportation Overview: This section provides comprehensive details on the total number of packets and different categories of dropped packets that occurred during the DDoS attack during the timeline defined in the above steps.

• Recent 10 DDoS Attack Reports: This section provides details about the attack report, affected resources, attack vector, and packet information as seen below.

• Location and protocol details: This section provides a breakdown of the protocols involved in DDoS attacks, the source of the attack, and details on protocol violations that occurred during past DDoS incidents.

• Raw DDoS mitigation and flow logs: Also, if you want to look at the raw DDoS logs, they are available as part of the workbook, so you don’t have to find them separately in the Log Analysis workspace. The DDoS mitigation flow logs listed here are based on sampled data.

• DDoS Metrics Tab: The DDoS Metrics tab graphically represents all the important metrics shown below, such as packet count, Syn packet threshold that triggers DDoS mitigation, inbound DDoS TCP/UDP packets, and whether you are under DDoS attack. For more information on these metrics, check out the referenced blog. here. Most of the metrics here are based on packets per second and packets per byte.

• Research tab: The Investigation tab in the workbook provides specific details on the number of packets dropped or allowed during past DDoS attacks, including the ports involved. This tab also provides information on the primary attack IPs and a timeline of mitigation activities, as detailed below.

conclusion:

Azure DDoS Protection is a powerful service that helps you protect your Azure resources from DDoS attacks. Azure DDoS Workbook provides valuable insights into attack traffic and mitigation measures so you can respond effectively and maintain the availability of your applications. Be vigilant and proactive in your defense against DDoS attacks to ensure the resilience of your online services.