Advanced DDoS Alerts Give Operators Control Over Attack Notifications

Cloudflare has introduced Advanced DDoS Alerts, a new notification tier that lets customers tailor attack alerts to their specific infrastructure and operational needs. Rather than receiving a blanket alert for every mitigated attack across all properties, users can now define exactly which alerts they want, for which attacks, and for which of their Internet properties.

The release covers two alert types:

  • Advanced HTTP DDoS Attack Alerts for WAF/CDN customers on the Enterprise plan who have also subscribed to the Advanced DDoS Protection service.
  • Advanced L3/4 DDoS Attack Alerts for Magic Transit and Spectrum BYOIP customers on the Enterprise plan.

Standard DDoS Alerts remain available to all customers, including those on the Free plan. The Advanced alert options are part of Cloudflare's broader Advanced DDoS service.

Why Alert on Automated Mitigations?

Cloudflare's DDoS protection is automated — mitigation decisions are made inline by the autonomous edge systems. But that automation doesn't eliminate the need for visibility. When the system inserts an ephemeral rule to stop an attack, operators of business-critical applications frequently want to verify that all malicious traffic is being blocked while legitimate users are unaffected. Because alerts fire the moment a mitigation decision is made, they let customers observe and confirm that their properties remain both protected and available in real time.

The tradeoff with the standard alerts is noise. Operators managing hundreds or even hundreds of thousands of Internet properties would be notified every time any single one comes under attack. Advanced DDoS Alerts address that overload by letting users select the specific properties they want to monitor:

  • Zones and hostnames for WAF/CDN customers
  • IP prefixes for Magic Transit and Spectrum BYOIP customers

Setting Your Own Attack Thresholds

Standard alerts also fire at very low, non-configurable thresholds designed to prevent email spam. Given that most DDoS attacks are quite small — as highlighted in recent attack trend reports — customers who only care about large-scale events may find the standard alerts too noisy, while those wanting to know about smaller attacks may find them too quiet.

Advanced DDoS Alerts put the threshold decision in the customer's hands:

  • WAF/CDN customers can set a minimum requests-per-second rate for HTTP attack alerts.
  • Magic Transit and Spectrum BYOIP customers can define packet-per-second and Megabit-per-second thresholds for L3/4 attack alerts.

Protocol-Level Filtering for L3/4 Alerts

Advanced L3/4 DDoS Alerts also expose protocol selection. A Magic Transit customer running mostly UDP applications may not need to be paged about TCP floods. Similarly, a Spectrum BYOIP customer who only handles HTTP/TCP traffic can ignore attacks mounted over other protocols. Users select the protocols they care about, and alerts are limited accordingly.

Creating an Alert

The process for creating an Advanced HTTP DDoS Alert is representative of both types. After logging in to the Cloudflare dashboard, navigate to Notifications and click Add. Choose either Advanced HTTP DDoS Attack Alert or Advanced L3/4 DDoS Attack Alert, depending on eligibility. Give the alert a name and optional description, select a delivery method such as Webhook, and continue.

Next, choose the domains or prefixes the alert should apply to. HTTP alerts can be narrowed to specific hostnames. Finally, set your minimum attack rate — requests per second for HTTP alerts, or packet/bit rates for L3/4 alerts — and save.

With per-property targeting, configurable size thresholds, and protocol filtering, the goal is straightforward: give operators actionable alerting that matches the realities of their own environments. Advanced DDoS Alerts are available now; more detailed configuration guidance is on Cloudflare's developer documentation site.