"We have DDoS protection" can mean very different things depending on whether it covers detection, mitigation, or both. They're genuinely separate jobs, solved by different mechanisms, and a vendor or a homegrown setup that only covers one half isn't actually protecting anything on its own.
What detection does
Detection answers one question: is an attack happening right now? That's threshold monitoring, AI anomaly detection, and threat-intelligence matching against known-bad IPs — the analysis layer that recognizes something is wrong and, ideally, what kind of something.
What mitigation does
Mitigation answers the next question: now that we know, how do we stop it? That's blocking an IP at the network level, advertising a BGP RTBH route upstream, or filtering malicious requests at the application layer — the action layer that actually removes the attack traffic.
Why detection without mitigation is just an alert
A system that only detects gives you a dashboard lighting up and, at best, a page to a human — while the attack continues in full force until someone manually intervenes. For a fast-moving volumetric flood, that gap between detection and human response is often the entire outage.
Why mitigation without detection doesn't work either
Mitigation has to know what to act on. Static, manually-configured blocking rules can stop known, unchanging threats, but without ongoing detection feeding it, mitigation has no way to react to a new attacker or a new attack pattern it hasn't been told about yet.
How the two connect end to end
In a working system, detection triggers mitigation automatically: an IP crosses a threshold, gets flagged by the AI engine, or matches a threat-intelligence feed — and that detection event immediately triggers a block, potentially followed by a BGP RTBH advertisement for large enough attacks. The tighter that loop, the smaller the window an attack has to do damage.
How eHAWK connects the two
eHAWK DDoS covers both ends of that loop natively: three independent detection triggers (threshold, AI, threat intelligence) feed directly into automatic blocking and, for volumetric attacks, automated BGP RTBH mitigation — with no manual step in between.