🛡️ Level Up Your DDoS Defense: 39 New Attack-Specific Templates!

We’re pumped to announce a massive expansion to our Kentik Protect alert policy templates! We’ve added 39 new, highly granular templates engineered to give you laser-focused visibility into specific attack vectors.

While our general reflection templates have always had your back, these new additions allow you to pinpoint the exact flavor of trouble hitting your network—from Memcached and DNS Reflection to more niche threats like Steam (SRCDS) or Mitel TP240 attacks.

⚡ What’s New?

We’ve moved beyond "one size fits all" to give you surgical precision. These templates are built to augment your existing setup by providing better granularity for specific attack types, including:

• Expanded Reflection Coverage: Dedicated templates for SNMP, mDNS, CLDAP, Lantronix Discovery, and CoAP reflection attacks.
• Protocol-Specific Protection: New alerts for GRE Flood, TCP Xmas Tree, TCP Null Flood, and TCP Invalid Flags.
• Specialized App Support: Custom templates for Plex Media SSDP, OpenVPN, and GQUIC reflection.

.

🎯 Why You’ll Love It

• Faster Identification: Stop guessing which service is being abused. The policy name now tells you exactly what you're looking at right in the Alerts List.
• Smarter Mitigations: By knowing the specific attack type (like a Fraggle Attack or WS-Discovery Reflection), you can tailor your automated system responses and mitigation platforms far more effectively.
• Granular Alerting: Fine-tune your thresholds for specific protocols rather than relying on a broad "General Reflection" policy.

🛠️ How to Enable & Tune Policies for Your Network

By default, these templates are imported in a disabled state so you can safely review and tune them before going live.

Step 1: Enable the Template

1. Head over to Alerting > Manage Alert Policies > Alert Policy Templates in the Kentik portal.
   KB Alerting.pdf
2. Search for the template name (e.g., DDoS: ARD Reflection Attack or DDoS: TCP Null Flood).
3. Click the Create policy from template icon to add the alert policy to your account.

Step 2: Tailor & Tune to Your Environment

Every network has its own unique baseline. Here is how you can make these templates fit seamlessly:

Adjust Static & Baseline Thresholds:

• For high-volume service provider backbones, scale up static packet/bit thresholds to match your transit capacities.
• For tight enterprise environments, lower the required percentage jump above historical baselines.

Refine Traffic Filters & Boundaries:

• Ensure your network boundary tags (e.g., internal vs external, or inside vs outside) are accurately defined so inbound flood policies evaluate traffic correctly.

Attach Notifications & Automated Mitigations:

• Link your team's preferred notification channels (Slack, PagerDuty, Webhooks, or Email) under the policy's Notifications section.
• For DDoS templates, attach Mitigation Associations if you want Kentik Protect to automatically trigger RTBH, BGP Flowspec, or third-party mitigation platforms upon activation!