DDoS Detection & Mitigation

A live console for request volume, unique IPs, and policy denials against the GuardFox platform itself, alongside a store of DDoS attack events, mitigation rules, and analyst notes.

Route: /ddos-detection

What DDoS Detection monitors

Overview

The DDoS Detection page shows real-time traffic metrics, a traffic-flow chart, a list of detected attack events, and configurable mitigation rules. While it is open it polls its four data endpoints every 3 seconds (the Live / Paused toggle stops and starts this).

Scope matters. The traffic metrics reflect load on the GuardFox dashboard application itself — request volume, unique IPs, and policy denials against this app — not traffic to your own protected website. GuardFox does not sit in front of your production infrastructure (no WAF/CDN role), so it has no visibility into whether your site is under attack. This caveat is shown in the page header.

Where the metrics come from

Application middleware records each request in-memory over a 60-second window (count, distinct client IPs, policy denials, and its own processing time), then flushes an aggregate into the TrafficMetric table. Because this measures the platform, not a tenant, the metric and traffic feeds are not organization-scoped: every organization sees the same genuine number.

Attacks and rules

Attack events come from the DdosAttack store and mitigation rules from the DdosRule store; both are scoped to your organization. The console lets analysts mitigate, annotate, and export attack records, and create or toggle mitigation rules. On an organization’s first visit, three default mitigation rules are seeded (see below).

Using the console

How to use

Header controls

Auto Mitigate / Manual Only — a display mode. In Manual Only, each active attack shows inline action buttons (Block Sources, Rate Limit, JS Challenge); in Auto Mitigate those buttons are hidden and an “Auto-mitigation active” badge appears when an attack is ongoing.
Live / Paused — toggles the 3-second polling of metrics, attacks, rules, and traffic.
Export CSV — downloads the attack log for your organization as a CSV file.

Detected attacks

Each attack card shows its type, severity, status, source-IP count, target port, and volume in packets/sec. Selecting a card opens a detail view with the attack description, start time, peak volume, a per-country source distribution, and the top source IPs (each with a one-click block action). When any attack has active status, a red banner is shown at the top of the page.

The seven recognized attack types are SYN Flood, UDP Flood, HTTP Flood, Slowloris, DNS Amplification, ICMP Flood, and NTP Amplification.

Analyst notes

In an attack’s detail view you can add free-text notes. Each note is stored with your email as the author and a timestamp, and is included in the CSV export.

Mitigation rules

The rules panel lists each rule’s name and type, with a switch to enable or disable it. + Add Rule opens a form where you set a name, pick a type, and optionally paste a JSON config. Available rule types are Rate Limit, Geo Block, IP Blacklist, JS Challenge, Pattern Block, and Connection Limit.

The three default rules seeded for a new organization are:

Rule	Type	Config	Enabled
Default Rate Limiting	rate_limit	`{"rps": 100}`	Yes
GeoIP Filter (High Risk Countries)	geo_block	`{"countries": ["RU","CN"]}`	Yes
JS Challenge enforcement	challenge	`{"difficulty": "medium"}`	No

Metrics and what they mean

Reference

The six metric cards read from the latest TrafficMetric record. Their meanings are deliberately narrow and honest:

Card	Field	Meaning
Requests/sec	`requestsPerSecond`	Requests to the GuardFox app over the reporting window
Avg Response	`avgResponseTime`	The middleware’s own processing time in ms (a narrow latency signal, not full page-load time)
Bandwidth	`bandwidth`	Not measured — there is no per-request byte counting, so this is always 0
Unique IPs	`uniqueIPs`	Distinct client IPs seen in the window
Denied (policy)	`blockedRequests`	Policy denials (RBAC / MFA gate / demo-mode write blocks) — not attack rate-limiting
Connections	`activeConnections`	Request count used as a proxy — there is no real connection-pool visibility at this layer

The Traffic Flow chart plots three series — Legitimate, Suspicious, and Blocked — over the last hour. Legitimate is derived as requests minus blocked, and Blocked is the policy-denial count. The Suspicious series is always 0 because the platform does not track a separate “suspicious but not blocked” bucket. Likewise, each rule’s hits value is always 0 — there is no per-rule enforcement counting yet.

Card colors change at fixed display thresholds (for example, Requests/sec turns amber above 1,000 and red above 5,000; Avg Response amber above 200 ms and red above 500 ms; Connections red above 500). These thresholds are for visual emphasis only.

API reference

Reference

All endpoints live under /api/ddos and require an authenticated session (they return 401 otherwise).

Method & path	Purpose
`GET /api/ddos/metrics`	Latest traffic-metric record (returns zeros if none exist)
`GET /api/ddos/traffic`	Traffic data points for the last hour
`GET /api/ddos/attacks`	Up to 50 attack events, newest first, for your organization
`GET /api/ddos/attacks/export`	CSV export of attack events
`POST /api/ddos/attacks/{id}/comments`	Append an analyst note to an attack
`POST /api/ddos/mitigate`	Mark an attack mitigated and record the action taken
`GET / POST / PATCH /api/ddos/rules`	List, create, and enable/disable mitigation rules

Attack fields

Each attack in the attacks array includes id, type, severity (low / medium / high / critical), status, sourceIPs, geoData, comments, and mitigationAction. Two values are derived at read time: packetsPerSecond is peakRps × 1.2, and targetPort is 80 when the target endpoint contains “80”, otherwise 443.

Mitigating an attack

The mitigate endpoint sets the attack’s status to mitigated, stores the action string, stamps a resolved time, and records a resolved alert (source ddos-engine) that triggers SOAR playbooks. The UI sends actions such as block_sources, rate_limit, challenge, or block_ip:, but any string is accepted.

curl -X POST https://app.guardfox.example/api/ddos/mitigate \
  -H "Content-Type: application/json" \
  -d '{"attackId":"","action":"block_sources"}'

Adding a note

curl -X POST https://app.guardfox.example/api/ddos/attacks//comments \
  -H "Content-Type: application/json" \
  -d '{"text":"Confirmed reflection from open NTP servers"}'

Creating a rule

curl -X POST https://app.guardfox.example/api/ddos/rules \
  -H "Content-Type: application/json" \
  -d '{"name":"Rate Limit: 200 rps","type":"rate_limit","config":{"rps":200},"enabled":true}'

To toggle a rule, send PATCH /api/ddos/rules with { "id": "", "enabled": false }.