As the internet continues to evolve, cybersecurity threats—particularly Distributed Denial of Service (DDoS) attacks—are an increasingly significant concern for organizations. In this post, we’ll look at how you can use Datadog to collect Google Cloud Armor (GCA) logs and detect and respond to potential DDoS attacks in real-time. But first, we’ll briefly cover what DDoS attacks are and how they work.

Modern cloud applications are made up of thousands of distributed services and resources that support an equally large volume of concurrent requests. This level of scale makes it more challenging for engineers to identify system failures before they lead to costly outages. System failures are often difficult to predict in cloud environments, and security threats add another layer of complexity.

In Part 1 of this series, we talked about some challenges with building sufficient coverage for detecting security threats. We also discussed how telemetry sources like logs are invaluable for detecting potential threats to your environment because they provide crucial details about who is accessing service resources, why they are accessing them, and whether any changes have been made.