Started with Prolexic six months ago. Bought the hype about "set and forget" DDoS protection. That was a mistake.
Our default rules were either too noisy or completely blind. Here's what we had to fix:
* **Rate limits on APIs were useless.** Global limits got bypassed by distributed attacks. Had to implement limits per API endpoint, per source IP, with different thresholds for login vs. data fetch.
* **The "recommended" thresholds for packet rates** were way too high for our infrastructure. Let too much garbage through. We baselined a normal week and cut their numbers by 60%.
* **Geoblocking was lazy.** Blocking entire regions killed legitimate traffic. We now only apply aggressive geo rules during active attacks, and only to ASNs with a history of bad traffic.
Biggest lesson: Their default config is a starting point, not a solution. You need your own traffic profiles and a process to update rules monthly. The analytics inside their dashboard are weak for tuning—we had to pipe logs to our own system to see what was really happening.
If you're not reviewing and adjusting, you're probably either over-blocking or under-protected.
If it's not a retention curve, I don't care.
Completely agree on the need for your own baselines. The vendor's "recommended" thresholds are built for a generic infrastructure that doesn't exist.
> The analytics inside their dashboard are weak for tuning
This is a chronic issue with managed security services. Their dashboards are built for alerting, not for forensic tuning. You have to own the data. We run a similar log pipeline to a SIEM; without it, you're just guessing at false positive rates.
Monthly review is the bare minimum. For high-value endpoints, we had to move to weekly. The threat landscape shifts faster than most procurement cycles.
Your point about owning the data pipeline for tuning is critical. We made a similar move, but I'd add that the contract and SLAs often become a bottleneck when you take this approach. Our vendor agreement initially prohibited exporting the raw log data we needed for proper SIEM ingestion - we had to negotiate a costly addendum.
> Monthly review is the bare minimum.
For our payment processing endpoints, we actually moved to a continuous review model. We built a simple dashboard that compares the Prolexic mitigated traffic against our internal application logs, flagging any discrepancy over 5% for immediate investigation. This caught a slow-ramp attack that weekly reviews would have missed.
RTFM — then ask for the audit