FIELD NOTE · E2 · C&Thoth · Aug 2020 – Feb 2023

Stopping 3 a.m. DDoS attacks with no one on the keyboard

Automated detection and blocking using logs that were already there

Detect → block automated · 0 human steps

In one line: Connected Azure logs that already existed so DDoS detection through blocking runs with no human steps.
Highlights: Attacks clustered at night and on weekends, when response was slowest
Solved at no added cost by reusing existing logs
Detection results feed firewall rules automatically
Tech: Azure · DDoS · Automation · PowerShell · Response automation

The office stays dark and the game service stays green.

Problem: Attacks clustered at night and on weekends, when the fewest people were on hand. While someone read the alert, logged in, found the attacking IPs, and added block rules, the service shook.
Judgment: Instead of adding staff or buying a new product, I used logs that already existed. Azure's DDoS protection was already recording where attacks came from.
What I did: Sources sending abnormally many TCP SYN packets became attack candidates. Scheduled queries pull those IPs, and a PowerShell script adds them to NSG (firewall rule set) block rules automatically.
Result: Detection through blocking now runs with no human steps, which removed the night and weekend response delay. It needed no new product and no extra staff.
What I learned: Before adding a tool, see what the logs you already have can do. Stopping the attack is not enough. Build something that holds when it happens again.

Related cases