[sofixa]

> Sec/ops doesn't normally involve looking at live network capture snapshots all day. ("Eyes on glass" monitoring exists, but that's not for common services) You're not distracting people from spotting exfil

No, but if the people on call are being drowned in alerts because everything is down due to the DDoS, an alert saying there's anomalous traffic ( if it's even capable to detect that during a DDoS, when all traffic would be anomalous depending on infrastructure) could be easily missed.

[viraptor]

From my experience handling on-call during DDoS, there's not much drowning in alerts. You mute alerts about things being down. Then look at ways to drop the biggest / isolated types of traffic. Then analyse what is affected and start logging the impact. I don't believe anything would be missed: security monitors would alert different people / channels than service ops, post-incident review would look at alerts raised, any weird traffic would be looked at during "isolate and kill traffic" stage.

Volume is not the only way to notify about anomalies. Poisoned data entries / canaries, outbound traffic which should never exist, unexpected DNS queries, and many others will trigger regardless of DDoS.

[dannyw]

You are assuming everyone has their sh*t together, which is often not the case.