The Business Monitoring page displays the service protection data of your Anti-DDoS Native instance, such as the traffic trends of protected assets and DDoS attack event records. It helps you track the security status of your services at any time. This topic describes how to query business monitoring data and explains the related data.
Prerequisites
You have purchased an Anti-DDoS Native instance and added protected objects to the instance.
For more information about the related operations, see Purchase an Anti-DDoS Native instance and Protected objects.
Background information
The Business Monitoring page supports querying only data from June 3, 2021, and later. To query historical data from before this date, see Manage instances.
Query business monitoring data
Log on to the Traffic Security console. In the left-side navigation pane, choose DDoS.
In the left-side navigation pane, choose .
In the top navigation bar, select the resource group to which the instances belong and the region in which the instances reside.
Anti-DDoS Native 1.0 (Subscription) instances: Select the region in which the instance resides.
Anti-DDoS Native 2.0 (Subscription) and Anti-DDoS Native 2.0 (Pay-as-you-go) instances: Select All Regions.
-
In the upper-left corner of the page, select the Anti-DDoS Native instance that you want to query.
-
View the business monitoring data of the Anti-DDoS Native instance. The Business Monitoring page contains four functional areas: ① the Statistics Overview area displays the number of days of continuous monitoring, Detection Peak, and Attack Mitigation Peak; ② the Traffic Chart area supports filtering by protected object, individual IP address, and time range (Last 30 Minutes, Last 1 Day, Last 7 Days, or Last 30 Days), and displays line charts of inbound traffic (bit/s) and data packets (pps). The legend distinguishes inbound traffic from attack traffic; the DDoS attack events table displays the attack time, event type, attacked IP address, triggered attack traffic in bit/s and pps, and peak attack traffic in bit/s and pps. In the Actions column, you can click View attack analysis; and the Attack trend area contains the Attack Trend (IP), Peak Attack Throughput (IP), and Attacked Duration (IP) tabs, and supports switching among the Last 1 Week, Last 1 Month, Last 3 Months, and Last 1 Year time ranges.
The following table describes the data that you can query on the Business Monitoring page and explains each data type.
Type
Purpose
Supported operations
Description
Service statistics (illustration ①)
Helps you understand the historical peak protection data of the Anti-DDoS Native instance, including the number of days of continuous monitoring and protection, all detected traffic peaks (bit/s and pps), and mitigated attack traffic peaks (bit/s and pps).
None.
Service traffic trends (illustration ②)
Helps you understand the inbound service traffic trends of the public IP assets that the Anti-DDoS Native instance protects, including the bandwidth (bit/s) trend and the packet forwarding rate (pps) trend.
Set the protected object and time range to query the related data.
DDoS attack events (illustration ③)
Helps you understand the attack events against the Anti-DDoS Native instance, including scrubbing events and blackhole filtering events, and lets you analyze and handle these events.
-
Set the protected object and time range to query the related data.
-
For a specific DDoS attack event record: Cancel Scrubbing in Advance, Download captured file, or View attack analysis.
Attack trend analysis charts (illustration ④)
Helps you analyze the overall trend of the network attacks that occurred on the Anti-DDoS Native instance over the past year, so that you can assess the attack risk to your services and your security protection requirements.
Set the time range to query the related data.
-
Service statistics
This area displays the following statistics:
-
Continuous Monitoring and Protection For: the number of days that the current Anti-DDoS Native instance has served you.
-
Detection Peak: the peak values of all service traffic that the Anti-DDoS Native instance detected while serving you, including the bandwidth (unit: bit/s) and the packet forwarding rate (unit: pps).
-
Attack Mitigation Peak: the peak values of the attack traffic that the Anti-DDoS Native instance scrubbed while serving you, including the bandwidth (unit: bit/s) and the packet forwarding rate (unit: pps).
Service traffic trends
This area contains the following charts:
-
Traffic (bit/s) peak trend chart: shows the bandwidth (unit: bit/s) trends of the total inbound traffic, total outbound traffic, and attack traffic of a specified protected object (IP address).
-
Packets (pps) peak trend chart: shows the packet forwarding rate (unit: pps) trends of the total inbound data packets, total outbound data packets, and attack data packets of a specified protected object (IP address).
You can set the following query parameters above this area:
-
Protected object: from the drop-down list, you can select All Protected Objects or a specific protected object (IP address) to query data for that protected object.
If you select All Protected Objects, you can click a data point on the trend chart to query the top 20 protected objects (IP addresses) that account for the largest proportion of the traffic data at that point in time.
-
Time range: click Last 30 Minutes, Last Day, Last 7 Days, or Last 30 Days to query data for the selected time range. You can also specify a custom time range.
When you specify a custom query time range, you can query data only from the last 30 days.
DDoS attack events
The attack event record table records all attack events that have occurred on the Anti-DDoS Native instance. Each attack event record contains the following information: Attack Time, Event, Attacked IP Address, Triggered Attack Traffic (bit/s), Triggered Attack Traffic (pps), Peak Attack Traffic (bit/s), and Peak Attack Traffic (pps).
Attack event records support the following operations:
-
Cancel Scrubbing in Advance: applies only to ongoing traffic scrubbing events. If you confirm that the current service traffic spike is unrelated to an attack, for example, because of a major sales event, you can use this operation to cancel traffic scrubbing in advance.
-
Download captured file: downloads the captured file of the attack event. You can use the captured file as evidence to report the incident to the relevant authorities.
-
View Attack Analysis: displays the detailed attack analysis data for the attack event. For more information about the attack analysis data, see Attack analysis.
Above the Service traffic trends area, you can set the following query parameters to filter attack events from the attack event record table: protected object and time range.
Attack trend analysis
The attack trend analysis displays the overall trend of the network attacks that occurred on the Anti-DDoS Native instance over the past year. It includes the following charts:
-
Attack Trend: shows the trend in the number of attacks against the Anti-DDoS Native instance, including Traffic Scrubbing Sessions, Blackhole Event, IP Addresses Under Traffic Scrubbing, and IP Address Under Blackhole Filtering.
-
Peak Attack Throughput: shows the trend in the peak traffic (unit: bit/s) of the attacks against the Anti-DDoS Native instance.
-
Attacked Duration: shows the trend in the duration of the attacks against the Anti-DDoS Native instance, including Less Than 10 Minutes, 10-30 Minutes, 30-120 Minutes, 2-10 Hours, and More Than 10 Hours.
In the upper-right corner of this area, you can set the query time range. Click Last 1 Week, Last 1 Month, Last 3 Months, or Last 1 Year to query data for the selected time range.