Skip to main content

​
Overview

Monitoring’s DDoS prevention module analyzes traffic patterns and automatically mitigates volumetric and application-layer attacks before they reach protected workloads. The module operates in two modes: Monitor (detection only) and Mitigate (automatic blocking).
Administrator Access Required — This operation requires the admin role. Contact your Polystack administrator if you do not have sufficient permissions.
Prerequisites
  • Administrator credentials with the admin role
  • Network flow collection configured (see Agent Configuration)
  • Baseline traffic patterns established (minimum 72 hours of Monitor mode data recommended)

​
Configuring DDoS Protection Policy

Navigate to DDoS Protection

Navigate to Monitor Center > Monitoring (DDoS Policies, admin view).

Configure detection settings

Start with Monitor mode to baseline normal traffic patterns for at least 72 hours before switching to Mitigate mode. Aggressive thresholds in mitigation mode may block legitimate traffic, causing customer-facing outages.

Add whitelist entries

Add IP ranges that should never be blocked regardless of traffic volume:
  • Monitoring system IPs (prevent self-blocking)
  • Partner or customer IP ranges with legitimate high-volume traffic
  • Internal automation systems
Navigate to Monitor Center > Monitoring (DDoS Whitelist, admin view).

Switch to Mitigate mode

After at least 72 hours of Monitor mode with no false positives:
  1. Review the alert history for any false positive detections
  2. Add any flagged legitimate sources to the whitelist
  3. Switch the policy to Mitigate mode
Policy shows Mitigate mode active. Check the DDoS Events feed to confirm no legitimate traffic is being blocked.

​
Reviewing DDoS Events

Navigate to Monitor Center > Monitoring (DDoS Events, admin view) to review detected and mitigated attacks:

​
Handling False Positives

If a legitimate source is incorrectly blocked:

Identify the blocked source

Check if a specific IP is blocked

Unblock the source

Unblock a specific source

Add to whitelist to prevent future blocks

Navigate to Monitor Center > Monitoring (DDoS Whitelist, admin view) and add the IP range of the legitimate source with a descriptive comment.
Source is unblocked and whitelist entry prevents future false positives.

​
Next Steps

Network Monitoring (User Guide)

User-level network traffic analysis for attack investigation

Alert Channels

Configure notification channels for DDoS detection events

Security

Overall Monitoring security configuration including access control

Troubleshooting

Diagnose false positive blocks and detection threshold tuning