Announcing the general
availability of the HTTP DDoS ruleset for Azure Web Application Firewall (WAF)
on Azure Front Door Premium.
HTTP-layer DDoS attacks remain a leading cause of
application downtime, and static controls such as IP filters and fixed rate
limits often can't keep pace with distributed botnets. The HTTP DDoS ruleset
provides automated, adaptive layer 7 protection that learns, detects, and
defends with minimal configuration. Once assigned, it continuously baselines
normal traffic for each Azure Front Door profile and, when a surge indicates an
attack, selectively mitigates offending clients with no emergency tuning required.
With general availability, the HTTP DDoS ruleset features:
- Automated traffic baselines
at both the profile and per-client level, with three sensitivity levels for
each rule.
- Two generally available
rules: one for clients sending anomalously high request rates, and one for
suspected bots identified by Microsoft Threat Intelligence.
- Support for WAF exceptions,
so trusted traffic such as health probes and load tests can be exempted from
the ruleset.
Two new geo rules in the ruleset are also available in preview.
They learn thresholds for the countries and regions that send most of your
traffic, plus a combined threshold for all others, to help mitigate highly
distributed attacks. All rules default to the Log action, so you can review
matches before enforcing them.
Learn
more.