DDoS Attack Response Quickstart
Time-boxed response path for an active denial-of-service attack. DDoS is a speed-plus-volume problem; mitigation latency kills more than attack magnitude. This path emphasizes rapid characterization, scrubbing activation, and parallel hunting for secondary intrusion that may be hidden behind the flood.
First 15 Minutes
Confirm DDoS vs Legitimate Surge
CriticalConfirm the traffic spike is an attack, not a marketing event, viral launch, or legitimate bot surge (search-engine crawl, partner integration). Check for anomalous source profiles (many low-throughput IPs, specific ASN concentration, reflector set with amplifying servers), request patterns (repetitive small packets, implausibly-formed requests), and magnitude vs baseline.
Characterize Attack Layer and Vector
CriticalClassify by layer (L3/L4 vs L7) and vector (SYN flood, UDP flood, reflection/amplification via DNS/NTP/Memcached/SSDP/CLDAP, HTTP flood, Slowloris, cache-buster, search-expensive queries). Mitigation differs per layer; applying a volumetric fix to an L7 attack wastes the window. Record peak pps, bps, and RPS.
Activate Upstream Scrubbing
CriticalActivate the pre-existing DDoS response contract with your upstream provider (Cloudflare, Akamai, AWS Shield Advanced, Fastly). If no contract, initiate emergency engagement immediately -- most providers offer emergency onboarding but at premium. Route volumetric traffic through scrubbing via BGP redirection or anycast DNS redirection.
First 60 Minutes
Apply Edge Rate Limits and Geo Controls
CriticalApply edge rate limiting per-IP and per-subnet on affected endpoints. For clear source concentrations, apply geo-blocking or ASN-blocking at the edge with a planned revert once the attack subsides. Start with less-aggressive limits and escalate; over-aggressive edge controls block legitimate users.
Enable L7 Mitigations for Application-Layer Attacks
CriticalFor L7 attacks: enable WAF rate limiting, bot management (Cloudflare Bot Management, Akamai Bot Manager, Imperva), JS challenges, and CAPTCHA on high-cost endpoints. Cache previously uncached responses, serve static fallback, and temporarily disable expensive search/filter endpoints if needed.
Parallel: Hunt for Secondary Intrusion
CriticalDDoS is sometimes used as cover for concurrent intrusion (data theft, ransomware staging, credential attacks). While the network team fights the flood, SOC should hunt for anomalous authentication, internal lateral movement, data egress, or new outbound C2 that may be hidden by the traffic event. This parallel track is commonly skipped and commonly regretted.
First 4 Hours
Customer Communications and Status
Update customer-facing status page on a defined cadence (every 30-60 minutes for active events). Without over-disclosing attack specifics, communicate impact and expected mitigation progress. Engage customer-success and support teams for account-level communication; track SLA credit exposure as you go.
Watch for Attack Morphing
Attack vectors change mid-attack as attackers probe for gaps in mitigation. Maintain ongoing characterization and be ready to adjust scrubbing profiles and WAF rules. Log the vector-by-vector progression so the post-incident review can size future resilience accurately.
Check for Extortion Demand and LEA Engagement
Some DDoS attacks are accompanied by ransom-DDoS (RDDoS) extortion demands. Do not pay. Engage law enforcement and scrubbing providers with ecosystem experience; they often have intelligence on the group and payment-doesn-not-help data. Coordinate with legal on any extortion-communication handling.
Kick Off Resilience Review
Within 4 hours, begin capturing inputs for the post-incident resilience review: mitigation latency (detection to scrubbing to full mitigation), capacity (attack traffic mitigated at each layer), architectural observations (origin exposure, DNS TTL effectiveness), cost impact. The freshest data is the most useful.
DFIR Assist — DDoS Attack Response Quickstart Quickstart | Printed 4/19/2026