Monitor the service at several layers
Enable platform reachability monitoring and add independent checks for the operating system, TLS endpoint, application and critical background jobs. A server that answers network probes can still have a failed database or application. Alert on symptoms that require action and document the expected response.
Protect public addresses
Register eligible addresses with Network Firewall, allow only required services and order specific rules before general ones. Enable DDoS mitigation appropriate to the address and workload. Review rules after a port, administrator network or application endpoint changes.
Prevent administrator lockout
Keep an out-of-band console path and a tested source address outside the rule being changed. Record the current firewall and routing configuration before editing it, add the replacement access path first and remove the old path only after a second session succeeds.
Investigate an incident
Establish the first affected time, compare network traffic with reachability and application alerts, and correlate recent reboots, deployments or route changes. Preserve authentication and application logs, isolate a compromised service before cleaning it and use the remote console only when normal administration is unavailable.
