# Metrics are enabled for DDoS-protected public IPs
When Azure DDoS Protection is enabled for public IP addresses, enabling metrics provides essential real-time visibility into attack activity, mitigation…
Source: https://maester.dev/docs/tests/ZTA.26885
## Overview
When Azure DDoS Protection is enabled for public IP addresses, enabling metrics provides essential real-time visibility into attack activity, mitigation effectiveness, and traffic patterns. Without metrics enabled on DDoS-protected public IPs, security teams lack the telemetry needed to detect ongoing attacks, validate that mitigation policies are working, and perform capacity planning. Azure DDoS Protection emits metrics such as "Under DDoS attack or not", inbound packets and bytes processed, packets and bytes dropped during mitigation, and TCP/UDP/SYN flood counters. These metrics are foundational for alerting, dashboards, and post-incident analysis. The absence of metrics prevents correlation of DDoS events with application performance issues and eliminates the ability to analyze attack patterns for proactive defense improvements. This check identifies all public IP addresses that are actually DDoS-protected — either through DDoS IP Protection enabled directly on the public IP, or through DDoS Network Protection inherited from a VNET that has a DDoS Protection Plan associated — and verifies that diagnostic settings are configured to capture metrics for security monitoring.
## Remediation
Enable metrics in diagnostic settings for DDoS-protected public IP addresses
- [Azure DDoS Protection metrics and alerts](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-diagnostic-logs)
Configure diagnostic settings for Azure resources
- [Configure diagnostic settings for Azure resources](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings)
Review DDoS Protection capabilities and overview
- [Azure DDoS Protection overview](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview)
Enable DDoS Network Protection on virtual networks
- [Quickstart: Create and configure Azure DDoS Network Protection using Azure portal](https://learn.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Azure Network Security |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Network security |
| Area | Logging and detection |
| ATT&CK | [T1498](/docs/tests?mitre=T1498) Network Denial of Service |
| Licence | DDoS_Network_Protection, DDoS_IP_Protection |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.