Metrics are enabled for DDoS-protected public IPs

Overview

When Azure DDoS Protection is enabled for public IP addresses, enabling metrics provides essential real-time visibility into attack activity, mitigation effectiveness, and traffic patterns. Without metrics enabled on DDoS-protected public IPs, security teams lack the telemetry needed to detect ongoing attacks, validate that mitigation policies are working, and perform capacity planning. Azure DDoS Protection emits metrics such as “Under DDoS attack or not”, inbound packets and bytes processed, packets and bytes dropped during mitigation, and TCP/UDP/SYN flood counters. These metrics are foundational for alerting, dashboards, and post-incident analysis. The absence of metrics prevents correlation of DDoS events with application performance issues and eliminates the ability to analyze attack patterns for proactive defense improvements. This check identifies all public IP addresses that are actually DDoS-protected — either through DDoS IP Protection enabled directly on the public IP, or through DDoS Network Protection inherited from a VNET that has a DDoS Protection Plan associated — and verifies that diagnostic settings are configured to capture metrics for security monitoring.

Remediation

Enable metrics in diagnostic settings for DDoS-protected public IP addresses

• Azure DDoS Protection metrics and alerts

Configure diagnostic settings for Azure resources

• Configure diagnostic settings for Azure resources

Review DDoS Protection capabilities and overview

• Azure DDoS Protection overview

Enable DDoS Network Protection on virtual networks

• Quickstart: Create and configure Azure DDoS Network Protection using Azure portal

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Azure Network Security
Product	Azure
Feature	Network security
Area	Logging and detection
ATT&CK	T1498 Network Denial of Service
Licence	DDoS_Network_Protection, DDoS_IP_Protection
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.