Detecting DDoS

[robust cobalt]

Hey, is there any way triggering a Webhook so i get a Message when a Domain is probably ddosed?

[royal brook]

There is a notification for an HTTP DDoS Attack (under Notifications account level in the dashboard), and you can use webhooks with notifications if you have at least one paid feature

The alerts are documented here: https://developers.cloudflare.com/ddos-protection/reference/alerts/#alert-types
Webhooks: https://developers.cloudflare.com/notifications/create-notifications/configure-webhooks/

[robust cobalt]

Okay thanks. Because my Plan is to send a Discord Webhook when my Service gets a DDoS, you know

@royal brook Hey, thanks for your help. I added some Notifications and get them now via email. But i cant find the place, where i can adjust and configure the webhooks

Or do i need a Plan or something like that?

[royal brook]

Webhooks require your account to have at least one paid feature https://developers.cloudflare.com/notifications/create-notifications/configure-webhooks/ like Pro for example

[robust cobalt]

Is there anything cheap i can pay to get it?

[royal brook]

hmm I don't know if the usage based subs like r2/etc count. If you wanted to do it for free, and you had a spare website in Cloudflare, you could enable email routing on it, and setup an Email Worker on "secret" email address which sends a webhook to your Discord. You'd have to do some coding/wrangler stuff if you're comfortable with that, example of an email worker that would let you do that: https://github.com/Tyler-OBrien/cloudflare-worker-emails-to-discord

[robust cobalt]

Okay thanks

[robust cobalt]

What exactly is a Zone Name? is it like the domain name?

[royal brook]

Is there more context to that?
Zones in Cloudflare is anything under the "Websites" tab, so yea you could say it's like a domain name, free plan can only add entire domains as Websites/Zones. If you're looking for your zone ID, bottom right of the overview page

[robust cobalt]

Ziel-Hostname and Zielzone is just fake-zone-name

[royal brook]

If you had "example.com" added as a website in Cloudflare, and a subdomain like "cookies.example.com", and it got attacked, Zielzone would be "example.com" and ziel-hostname would be "cookies.example.com"

[robust cobalt]

ah okay, so if i want to get all notifies filtered for modguard.xyz i check if zielzone is modguard.xyz?

[royal brook]

that's what it would be, yea

[robust cobalt]

👍