# Check DDoS IP protection state when public-IP telemetry disappears

> A missing metric can reflect the documented protection-state boundary.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-093-check-ddos-ip-protection-state-when-public-ip-telemetry-disappears/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:27+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

A missing metric can reflect the documented protection-state boundary.

## Potentially affected

Use this check when a protected public IP's monitoring view becomes empty or an expected attack series is absent. Identify the exact IP resource, metric and observation period, then review its protection state and relevant configuration changes.

## DSE recommendation

DSE recommends checking the documented conditions for metric availability before changing an alert or rebuilding its destination.

## Article

## Source facts

Microsoft states that public-IP resource telemetry is unavailable after DDoS IP protection changes from enabled to disabled. Its monitoring guide also distinguishes mitigation-trigger metrics, available during peace time, from other attack telemetry that is available only after a public IP has been under mitigation. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/ddos-protection/monitor-ddos-protection).

## Applicability

Use this check when a protected public IP’s monitoring view becomes empty or an expected attack series is absent. Identify the exact IP resource, metric and observation period, then review its protection state and relevant configuration changes.

## DSE recommendation

DSE recommends checking the documented conditions for metric availability before changing an alert or rebuilding its destination. Correlate a protection-state change with the first missing observation and give the security owner the resulting evidence. Any decision to change protection should follow the service’s approved security requirements; an empty chart alone should not drive that change.

## Verification

Compare the actual resource configuration and change history with the selected metric and time window. Record which telemetry should be available in that state, and investigate a mismatch against that expectation. Keep independent service-availability observations alongside the metric review. If attack validation is required, use an authorized provider-supported exercise and preserve its resource and timing evidence.

## Official references

[Microsoft Learn: Monitor Azure DDoS Protection](https://learn.microsoft.com/en-us/azure/ddos-protection/monitor-ddos-protection).

## Primary reference

- Name: Monitor Azure DDoS Protection | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/ddos-protection/monitor-ddos-protection
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check DDoS IP protection state when public-IP telemetry disappears,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-093-check-ddos-ip-protection-state-when-public-ip-telemetry-disappears/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.