What is a Mitigation Profile?
A Mitigation Profile defines how RADAR works during a simulation.
It defines the scope, execution parameters, and evaluation criteria for the simulation, based on the configured Targets, Security Layers, and Validation Settings.
What You'll Learn on This Page
On this page, you'll learn how to create a Mitigation Profile, which is required to initiate and run simulations, and you’ll be guided through the configuration process.
Creating a Mitigation Profile
Follow these steps to add a Mitigation Profile in the RADAR platform:
- In the left-hand navigation menu, click Environment.
- Select Mitigation Profiles.
- Click the Add Profile button.
-
Fill in the following fields:
• Profile Name
• Profile Description - Click Save to apply and save your changes
The Validation Mode column indicates how traffic is processed and validated based on the detectors deployed in your environment.
Observation-Based
Traffic is analyzed using detectors connected to mirror ports.
In this mode, RADAR observes real network traffic, providing visibility into how existing traffic is handled by your security infrastructure.
Iteration-Based
Primarily used for Layer 3 and Layer 4 testing, this mode relies only on monitoring. RADAR generates traffic at an incrementally increasing rate and evaluates the mitigation system's response based on deviation from expected behavior.
Once the Profile is created, click the Edit icon of each Profile to configure Validation Settings and Traffic Settings.
Complete the Profile Configuration
Info
Under this tab, you can view the Profile Name, Profile Type, and optionally provide a Description to further identify your Profile.
Simulation Settings
Configure the Validation Cycle settings to determine how the platform distributes traffic across attack nodes during the simulation.
The Validation Cycle configuration includes:
- Unique Groups Number - Specifies the number of attack nodes (or node groups) to be used during the simulation.
- Switch Group After - Defines how many simulation cycles should run before rotating to the next group of nodes.
Configure the Status Governance settings to determine when the platform begins evaluating and classifying each Target’s protection status during a DDoS simulation.
It is recommended not to modify the default configuration, as changes may impact the behavior of simulation cycles. Please consult your Technical Account Manager before making any adjustments.
Traffic Settings
Select the Network Interfaces to be included in the simulation cycle for this Mitigation Profile.
CDN and Proxy Settings
- Traffic Analysis - Parsing
When traffic passes through a CDN or proxy, the original source IP may be masked. This setting allows the platform to accurately identify the original source IP, even when traffic passes through a CDN or proxy. The proxy header that reveals the original source IP appears in the CDN Forwarding Header field. Note that this functionality should be enabled only when the original source IP has been altered.
Under CDN Forwarding Header, you’ll see the proxy header used to reveal the true source IP of the traffic. - Global Setting
Enable Global Proxy Mode if your environment relies on proxy-based security layers or if the original source IP is masked by the proxy.
The value entered under "CDN Forwarding Header" should match the exact name of the header as it is configured in your environment.
What's Next
Now that you’ve created a Mitigation Profile, proceed to How to Add Targets to set up your Targets and run your first simulation.