MedTech Inc. has deployed DDoS Protection Standard on their virtual network for a public-facing API. They observed a volumetric attack and want to minimize false positives from legitimate traffic spikes from a global CDN. Which DDoS Standard feature should they rely on, and what telemetry will help them tune the protection?

DDoS Protection Standard uses adaptive tuning (auto-tuning) to automatically learn an application's normal traffic patterns and adjust protection thresholds accordingly. This is crucial for distinguishing legitimate traffic spikes, like those from a CDN, from actual DDoS attacks, minimizing false positives. Azure Monitor metrics such as DDoSProtectedIPCounter (showing the number of protected public IP addresses) and DDoS mitigationFlow (indicating active mitigation flows) provide real-time insights into protection status. Diagnostic logs offer detailed mitigation history, helping to evaluate the effectiveness of the tuning. Disabling DDoS Standard and relying solely on NSGs is insufficient for volumetric attacks and lacks specialized DDoS telemetry. Manually changing static thresholds is reactive and prone to errors, especially with dynamic CDN traffic; Azure Security Center offers general recommendations, not specific DDoS threshold tuning. While Azure Front Door WAF provides DDoS protection, it's a separate service, and DDoS Protection Standard offers dedicated, granular protection at the virtual network level, with specific telemetry for its operations.