Generally Available: HTTP DDoS ruleset for Azure Front Door Premium WAF

Announcing the general availability of the HTTP DDoS ruleset for Azure Web Application Firewall (WAF) on Azure Front Door Premium. HTTP-layer DDoS attacks remain a leading cause of application downtime, and static controls such as IP filters and fixed rate limits often can't keep pace with distributed botnets. The HTTP DDoS ruleset provides automated, adaptive layer 7 protection that learns, detects, and defends with minimal configuration. Once assigned, it continuously baselines normal traffic for each Azure Front Door profile and, when a surge indicates an attack, selectively mitigates offending clients with no emergency tuning required.

With general availability, the HTTP DDoS ruleset features:

- Automated traffic baselines at both the profile and per-client level, with three sensitivity levels for each rule.

- Two generally available rules: one for clients sending anomalously high request rates, and one for suspected bots identified by Microsoft Threat Intelligence.

- Support for WAF exceptions, so trusted traffic such as health probes and load tests can be exempted from the ruleset.

Two new geo rules in the ruleset are also available in preview. They learn thresholds for the countries and regions that send most of your traffic, plus a combined threshold for all others, to help mitigate highly distributed attacks. All rules default to the Log action, so you can review matches before enforcing them.

Learn more.