Handle a false positive
A false positive is an incorrect identification. In the case of DDoS protection, there is a false positive when legitimate traffic is mistakenly classified as attack traffic. This can occur when legacy applications, Internet services, or faulty client applications generate legitimate traffic that appears suspicious, has odd traffic patterns, deviates from best practices, or violates protocols.
In these cases, Cloudflare’s DDoS Protection systems may flag that traffic as malicious and apply mitigation actions. If the traffic is in fact legitimate and not part of an attack, the mitigation actions can cause service disruptions and outages to your Internet properties.
To remedy a false positive:
Go to the analytics dashboard and apply filters to the displayed data.
For WAF/CDN customers
- Select the zone that is experiencing DDoS attack false positives.
- Go to Security > Events.
- Select Add filter and filter by
Service equals HTTP DDoS.
For Magic Transit and Spectrum customers
- Go to Account Home > Analytics & Logs > Network Analytics.
- Identify the legitimate traffic that is causing the false positives. Use the Attack ID number included in the DDoS alert (if you received one), or apply dashboard filters such as destination IP address and port.
Scroll down to Top events by source > HTTP DDoS rules.
Copy the rule name.
Go to your zone > Security > DDoS and select Deploy a DDoS override. If you cannot deploy any additional overrides, edit an existing override to adjust rule configuration.
Select Browse rules and paste the rule name in the search field.
Decrease the rule’s Sensitivity Level to Essentially Off or change the rule action to Log (if supported by your current plan and subscriptions).
Select Next and then select Save.