Enable and configure DDoS Alerting, Logging and Metrics
Implementation Effort: Medium
User Impact: Low
Overview
Enable and configure DDoS alerting, logging, and metrics to gain actionable insights into volumetric and protocol-based attacks and validate your protection posture.
First, turn on diagnostic settings for your DDoS Protection Plan (and any protected public IPs) to stream 'DDoSProtectionNotifications', 'DDoSMitigationReports', and DDoSMitigationFlowLogs logs into a Log Analytics workspace or Event Hub. Next, configure Azure Monitor metric alerts on key metrics —such as IfUnderDDoSAttack to notify your security teams or trigger automated playbooks when DDoS events occur.