1. Detection
Define the alerts that indicate an attack: sudden traffic spikes, unusual protocols, saturated links, service health checks failing.
2. Triage
Record the target address, attack type, volume and start time. Check whether the attack threatens shared infrastructure.
3. Choose mitigation
- Shared links at risk → blackhole the target immediately.
- Target critical and attack pattern clear → flowspec rules.
- Sustained attack on a critical service → engage scrubbing.
List who is authorised to trigger each and the exact steps.
4. Communicate
Notify internal stakeholders, inform affected customers and contact providers with the details they need.
5. Monitor and adjust
Attackers change tactics. Keep watching and adjust filters.
6. Review
After the incident, document timelines, what worked and what did not, and update the runbook.
Peer1IX DDoS Protection customers get detection alerts and support during incidents.
