What You'll Learn on This Page
This page outlines deployment best practices for setting up and configuring your RADAR environment. It provides guidance on establishing Targets, configuring network connections, and validating mirror port functionality to ensure accurate and reliable DDoS simulation results. Following these practices helps ensure consistent testing performance, operational efficiency, and comprehensive visibility across all mitigation layers.
1. Enable the BaseLine Attack Vector Group for New Targets
During initial deployment, or when new Targets are added to RADAR, we recommend enabling the BaseLine attack vector group. This group contains the most critical and commonly used DDoS simulations, ensuring that key attack vectors are tested across all relevant security layers. Starting with BaseLine provides a solid foundation for validating your environment before expanding coverage to BaseLine Plus or Full Coverage groups. MazeBolt’s Professional Services team recommends completing and verifying all BaseLine simulations before proceeding to broader testing scenarios.
2. Incorporate a Diverse Set of Targets Across your Environment
To achieve comprehensive coverage across your environment, incorporate a diverse set of Targets representing different network segments, services, and security policies during deployment. Including assets such as web applications, APIs, DNS, and CDN endpoints ensures an accurate assessment of your organization’s protection posture and helps identify potential coverage gaps between security layers.
Each critical business service should be represented by at least one Target to ensure complete validation of your DDoS mitigation effectiveness
3. Deploy Mirror Ports Strategically
When configuring multiple mirror ports for traffic analysis, begin with direct (non-proxy) security layers, where the original source IP address remains intact, such as the SCB or CPE. After validating these layers, extend the deployment to proxy-based security layers such as the WAF or CDN.
This deployment order enables faster data collection and accelerates the availability of actionable simulation results. It also ensures full visibility into traffic behavior across all security layers and prevents data duplication or overlap.
Before executing simulations, ensure that all mirror ports are fully operational. Run diagnostic tests to confirm that each configured mirror interface is detecting traffic accurately and that mirrored data originates from the correct network segment.
To perform a diagnostic test, navigate to the Target page, open the Edit tab, and under General, select Diagnostic. In the diagnostic window, define the required parameters and initiate the test to verify connectivity, traffic detection, and data integrity. For additional details, refer to the How to Add a Target page.
4. SIEM Logs Management Best Practices
- Collect Logs from Critical Systems
Integrate all security-related data sources, including firewalls, IDS/IPS, WAFs, and cloud services. - Standardize and Normalize Logs
Convert logs from different products into a consistent format to ensure accurate analysis and correlation. - Define Correlation Rules
Establish rules to identify specific attack patterns and detect suspicious behavior across systems. - Ensure Log Retention
Retain logs for a defined period (typically 6–12 months) to support forensic investigations and compliance requirements. - Automate Threat Detection
Leverage Machine Learning (ML) and User Behavior Analytics (UBA) to detect anomalies and enhance response times. - Regularly Audit SIEM Logs
Review SIEM alerts and configurations routinely to ensure accuracy, reduce noise, and maintain effective monitoring.