Check DDoS IP protection state when public-IP telemetry disappears

Source facts

Microsoft states that public-IP resource telemetry is unavailable after DDoS IP protection changes from enabled to disabled. Its monitoring guide also distinguishes mitigation-trigger metrics, available during peace time, from other attack telemetry that is available only after a public IP has been under mitigation. Microsoft Learn.

Applicability

Use this check when a protected public IP’s monitoring view becomes empty or an expected attack series is absent. Identify the exact IP resource, metric and observation period, then review its protection state and relevant configuration changes.

DSE recommendation

DSE recommends checking the documented conditions for metric availability before changing an alert or rebuilding its destination. Correlate a protection-state change with the first missing observation and give the security owner the resulting evidence. Any decision to change protection should follow the service’s approved security requirements; an empty chart alone should not drive that change.

Verification

Compare the actual resource configuration and change history with the selected metric and time window. Record which telemetry should be available in that state, and investigate a mismatch against that expectation. Keep independent service-availability observations alongside the metric review. If attack validation is required, use an authorized provider-supported exercise and preserve its resource and timing evidence.

Official references

Microsoft Learn: Monitor Azure DDoS Protection.