DDoS protection

Traffic, top talkers, attacks, alerts, events, mitigations, and transit use. Required resource or feature: Distributed denial of service (DDoS) protection and protected network.

Metric families and dimensions

Traffic and attack queries can use network, site, virtual host, source/destination, protocol, and time dimensions where supported. Observe the system restrictions in each row. Network discovery identifies supported networks; top-N queries rank results rather than enumerate every flow.

Use Query concepts for shared request guidance and table conventions.

Statistics and analytics queries

Method and exact path	Information returned	Scope and principal filters	Specification reference
POST /api/data/namespaces/{namespace}/infraprotect/bgp_peer_status	BGP Peer Status; returns items	Selected namespace; time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/infraprotect/transit_usage	Transit Usage; returns data, step	Selected namespace; end_time, field_selector, filter, group_by, range, start_time, step	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/graph/l3l4/by_application/{network_id}	l3l4 Application traffic Query; returns in, out	Tenant; system only; network_id, end_time, start_time, traffic_unit	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/graph/l3l4/by_mitigation/{mitigation_id}	l3l4 Mitigation Traffic Query; returns rates	Tenant; system only; mitigation_id, end_time, sort, start_time, top_n, traffic_unit	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/graph/l3l4/by_network/{network_id}	l3l4 Network Traffic Query; returns in, out	Tenant; system only; network_id, end_time, start_time, traffic_unit	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/graph/l3l4/by_zone/{network_id}	l3l4 Zone Traffic Query; returns in, out	Tenant; system only; network_id, end_time, routed_traffic, start_time, traffic_unit	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/graph/l3l4/event_count/{network_id}	l3l4 Event count; returns events	Tenant; system only; network_id, end_time, start_time, step	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/graph/l3l4/top_talkers/{network_id}	l3l4 Top talkers Query; returns data, traffic_unit	Tenant; system only; network_id, end_time, start_time, traffic_type, traffic_unit	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/alert/{alert_id}	DDoS Alert; returns misuse_types, ports, prefixes, tcp_flags	Tenant; system only; alert_id	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/infraprotect/alerts	DDoS Alerts; returns alerts	Tenant; system only; alert_type_ddos, alert_type_infrastructure, end_time, event_id, network_id, start_time	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/event/{event_id}	Event details; returns event	Tenant; system only; event_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/event/{event_id}/alerts	Event alerts; returns alerts	Tenant; system only; event_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/event/{event_id}/details	of event details; returns details	Tenant; system only; event_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/event/{event_id}/mitigation_annotations	Event mitigation annotation; returns mitigations	Tenant; system only; event_id	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/infraprotect/events	of events; returns events	Tenant; system only; end_time, mitigation_id, network_id, start_time	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/events_summary	Simple events view; returns events	Tenant; system only; alert_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/mitigation/{mitigation_id}	Mitigation details; returns details, prefixes	Tenant; system only; mitigation_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/mitigation/{mitigation_id}/annotations	Mitigation annotations; returns annotations	Tenant; system only; mitigation_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/mitigation/{mitigation_id}/countermeasures	Mitigation Countermeasures; returns aif_and_http_url_regular_expression, dns_auth, dns_malformed, dns_nxdomain_ratelimiting, dns_object_ratelimiting	Tenant; system only; mitigation_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/mitigation/{mitigation_id}/ips	Mitigation IPs; returns ips	Tenant; system only; mitigation_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/mitigation/{mitigation_id}/ips/download	Mitigation IPs Download; returns ips	Tenant; system only; mitigation_id	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/infraprotect/mitigations	of mitigations; returns mitigations	Tenant; system only; end_time, event_id, network_id, start_time	Operation · Request schema · Response schema

Related discovery and status

Method and exact path	Information returned	Scope and principal filters	Specification reference
GET /api/infraprotect/namespaces/{namespace}/infraprotect/networks	Available DDoS protection networks	Tenant; system only; No additional selector	Operation · Request schema · Response schema

Existing reports and artifacts

Method and exact path	Information returned	Scope and principal filters	Specification reference
GET /api/infraprotect/namespaces/{namespace}/infraprotect/event/{event_id}/attachments	Event attachments; returns attachments; source marks deprecated	Tenant; system only; event_id	Operation · Request schema · Response schema
GET /api/infraprotect/namespaces/{namespace}/infraprotect/report/{report_id}	Report details; returns attachment	Tenant; system only; report_id	Operation · Request schema · Response schema
POST /api/infraprotect/namespaces/{namespace}/infraprotect/reports	reports; returns reports	Tenant; system only; end_time, start_time	Operation · Request schema · Response schema