Availability is the target
A denial-of-service attack attempts to make a service unavailable to legitimate users. A distributed attack involves traffic or activity from multiple sources. The operational consequence can be failed connections, timeouts or an application that cannot complete useful work.
An incident may affect a network link, a stateful device or the application itself. The visible symptom does not always identify the resource that failed first.
Look beyond one traffic chart
Compare network traffic, new connections, HTTP responses, application latency and dependency health for the same interval. A high request count with healthy responses is different from an exhausted database with modest network use.
Establish what changed before the incident. A release, campaign, crawler or failed integration can also explain unexpected demand. Use evidence rather than treating every spike as malicious.
Why layered protection matters
A network protection service and a web application policy solve different parts of the availability problem. Review the full path from DNS and connectivity to the edge, origin and dependencies. A missing layer can leave a service unavailable even when another layer is working.
Decide which team owns each boundary and how incidents are escalated. This is especially important when hosting and application protection come from different providers.
Build a useful incident record
Record when users first reported problems, which journeys failed and what monitoring showed. Keep the timeline of mitigations and their effects. After recovery, use that record to improve detection and response rather than reporting only a peak traffic number.