TTechclick ⚡ XP 0% All lessons
Radware · DDoS Protection · ERT & APSolute VisionInteractive · L1 / L2 / L3

Radware ERT & APSolute Vision — The Human Team and the Single Console

Radware fights DDoS with two layers: an expert team and a management plane. The Emergency Response Team (ERT) is 24x7 humans who remote into your DefensePro to tune and write signatures live, fed by the ~15-minute Active Attackers Feed. APSolute Vision is the single console that configures, monitors and reports across up to 1,000 devices. This lesson maps how people, feed and console work together.

📅 2026-06-18 · ⏱ 16 min · 5 infographics · live attack demo · 🏷 10-Q assessment + AI Tutor inline

⚡ Quick Answer

A clear, interactive guide to Radware DDoS defense (2026): the 24x7 Emergency Response Team (ERT) that remotes into DefensePro to mitigate live attacks, the ~15-minute ERT Active Attackers Feed (EAAF) that pre-emptively blocks known botnets, and APSolute Vision — the single console that manages, monitors and reports across up to 1,000 devices — plus the ERT Silver/Gold packages and the MSSP Portal for managed service.

🎯 By the end you will be able to

Read as:

Pick where you want to start

1

People + platform

Why DDoS defense needs a team and a console.

 2

ERT & the feed

24x7 SOC, under-attack flow, ~15-min EAAF.

 3

APSolute Vision

One console for up to 1,000 devices.

 4

Managed service

ERT Silver/Gold, MSSP Portal, self vs buy.

🧠 Warm-up — 3 questions, no score

Just notice which ones make you pause. We answer all three inside the lesson.

1. Is Radware DDoS defense only an automated appliance?

Answered in People + platform.

2. How often is the ERT Active Attackers Feed refreshed?

Answered in ERT & the feed.

3. How many devices can APSolute Vision centrally manage?

Answered in APSolute Vision.

Most engineers think…

Most people picture DDoS protection as 'an appliance that auto-blocks floods'. That mental model breaks the moment a multi-vector attack arrives faster than any single box can adapt.

Radware splits the job into people and a platform: the Emergency Response Team (ERT) is 24x7 humans who remote into your DefensePro to analyse an attack and write signatures live; the ERT Active Attackers Feed (EAAF) is automated intelligence pushed every ~15 minutes to block known attackers pre-emptively; and APSolute Vision is the single console where you configure, monitor and report across the whole estate. Understanding that split is what lets you size the console, switch the feed on safely, and know exactly when to call the humans.

① People + platform — why DDoS defense needs both

The single most important idea: Radware does not hand you 'one box that blocks everything'. It pairs a human expert team with a central management plane. Automation handles the known and the fast; humans handle the novel and the messy — the multi-vector attack that mutates while it runs.

The Emergency Response Team (ERT) is the people layer: a 24x7 group, backed by Radware's SOC, that you call when an attack outruns your shift. APSolute Vision is the platform layer: one console to configure, monitor and report across every DefensePro, Alteon and AppWall you own. Pure automation fails on a fresh IoT botnet with a new DNS vector — which is exactly when the ERT remotes in and tunes.

Legenddiagram titlestage namewhat the stage doesflow arrows & bordersdiagram canvas
Figure 1 — The Radware DDoS loop — detect, feed, call, mitigate, report
Radware DDoS defense runs the same loop: automated detection and feed, human escalation when needed, then reporting.The Radware DDoS loop — detect, feed, call, mitigate, reportDetectDefensePro sees floodFeedEAAF blocks knownCall ERTinvoke under attackMitigatetune + custom sigsReportdashboards + RCA
Radware DDoS defense runs the same loop: automated detection and feed, human escalation when needed, then reporting.
Figure 2 — Two layers, one defense
Radware pairs an automated platform layer with a human expert layer against the same attack.Two layers, one defenseHuman layer — ERT24x7 experts remote into DefensePro liveFeed layer — EAAFActive attackers pushed about every 15 minutesPlatform layer — VisionOne console for up to 1,000 devices
Radware pairs an automated platform layer with a human expert layer against the same attack.
Quick check · Q1 of 10 · Understand

Radware DDoS defense is best described as…

Correct: a. Radware pairs people (the ERT) with a platform (APSolute Vision over DefensePro). Automation handles the known and fast; the human ERT handles novel multi-vector attacks the box cannot adapt to alone.
👉 So far: Radware DDoS defense = people + platform: the ERT (24x7 human experts) plus APSolute Vision (the console) over DefensePro — automation for the known, humans for the novel multi-vector attack.

② Inside the ERT and the Active Attackers Feed

When you invoke the ERT under attack, experts gain direct control of your DefensePro device(s). They assess the live attack, enable or tune behavioural features, and add custom signatures to restore service — hands-on mitigation, not just advice. The ERT leans on Radware's SOC and Security Update Service (SUS) for the latest coverage, and it is the human backbone of the DDoS Attack Mitigation Service and the fully managed Cloud DDoS Protection Service.

The feed that blocks before the attack

The ERT Active Attackers Feed (EAAF) is the automated cousin of the team. It is a real-time list of currently-active attackers — evolving IoT botnets and new DNS vectors — built from ERT botnet algorithms plus manual research, scored in a big-data cloud platform, and pushed to DefensePro about every 15 minutes so it can block attackers before an attack starts. EAAF supports per-category and risk-level control (High/Medium/Low), a Report-Only mode, and categories such as Tor and Web Attacker — all managed from APSolute Vision 4.30 or later.

🚨
ERT (Emergency Response Team)
tap to flip

Radware's 24x7 experts who take direct control of DefensePro during an attack to analyse, tune and write custom signatures live.

📡
EAAF (Active Attackers Feed)
tap to flip

Real-time feed of currently-active DDoS attackers pushed to DefensePro about every 15 minutes for pre-emptive blocking.

🖥️
APSolute Vision
tap to flip

Central console to configure, monitor and report on DefensePro, Alteon and AppWall across up to 1,000 devices.

🛡️
DefensePro
tap to flip

Radware's inline, real-time DDoS mitigation device that the ERT controls and that consumes EAAF and SUS updates.

Separate the team from the feed

In an interview, do not blur them: the ERT is the 24x7 human team you call when automation isn't enough; the EAAF is automated threat intelligence pushed to DefensePro about every 15 minutes. One is people taking control of your box; the other is a list of attackers your box blocks on its own.

Quick check · Q2 of 10 · Remember

How often is the ERT Active Attackers Feed (EAAF) pushed to DefensePro?

Correct: b. EAAF is refreshed about every 15 minutes with currently-active attackers, so DefensePro can block known sources pre-emptively before an attack starts.
👉 So far: ERT = experts who remote into DefensePro to tune and write signatures live; EAAF = automated active-attacker feed pushed about every 15 minutes for pre-emptive blocking, with Report-Only and per-category control.

③ APSolute Vision — the single pane of glass

APSolute Vision is where the estate is run from. One console centrally manages up to 1,000 devices across multiple data centers — setup, configuration, software management and true performance management of DefensePro, Alteon and AppWall. You stop logging into every box to see an attack or change a policy.

What the console actually gives you

Real-time, customizable dashboards with attack analytics; centralized attack management, monitoring and reporting with real-time identification, prioritization and response. It aggregates and normalizes events, correlates them, supports Root Cause Analysis, and alerts via email, SNMP traps and Syslog. RBAC gives granular per-user/per-group roles (monitor-only, config, alerts, reports) scoped to selected devices, authenticated by a local server or RADIUS. It deploys as a physical or virtual (Hyper-V/KVM) appliance.

Figure 3 — APSolute Vision — one console, every device
APSolute Vision centralises configuration, monitoring and reporting across the whole Radware portfolio.APSolute Vision — one console, every deviceAPSolute Visionsingle consoleDefensePro (DDoS)Alteon (ADC)AppWall (WAF)EAAF profilesRBAC + RADIUSReports + alerts
APSolute Vision centralises configuration, monitoring and reporting across the whole Radware portfolio.
'APSolute Vision manages anything' over-claim

APSolute Vision manages the Radware portfolio — DefensePro, Alteon and AppWall — up to 1,000 devices. It does not centrally manage arbitrary third-party gear like a Cisco router. Naming the portfolio (not 'everything') is the precise answer.

▶ Watch a DDoS flood get blocked and mitigated end-to-end

How an attack on a customer is stopped — feed first, then humans. Press Play for the healthy path, then Break it to see the classic failure.

① FloodAn IoT botnet launches a volumetric multi-vector flood with DNS amplification at customer IP ranges.
▼
② Feed blocksDefensePro drops sources already on the ~15-minute EAAF, cutting the known portion of the attack instantly.
▼
③ Invoke ERTThe novel DNS-amplification vector outruns automation, so the on-call shift invokes the ERT hotline.
▼
④ Mitigate + reportERT experts remote into DefensePro, tune behavioural signatures and add a custom signature; APSolute Vision shows clean traffic restored.
Press Play to step through the healthy mitigation path. Then press Break it.
Quick check · Q3 of 10 · Apply

You need to configure, monitor and report on 200 DefensePro devices across several data centers from one place. What do you use?

Correct: a. APSolute Vision is the single console that centrally manages up to 1,000 devices — setup, dashboards, correlated alerts and reporting — so you never log into each box individually.
👉 So far: APSolute Vision = one console for up to 1,000 DefensePro/Alteon/AppWall devices: dashboards, attack analytics, normalized/correlated alerts (email/SNMP/Syslog), RBAC via local or RADIUS, physical or virtual.

④ The managed-service angle — Silver, Gold and the MSSP Portal

Not every team wants to run this in-house. Radware packages the human and feed layers as subscriptions: standalone EAAF; ERT Silver (SUS + EAAF + Geolocation); and ERT Gold (Silver plus the ERT Under Attack Service — the live, hands-on mitigation). EAAF on its own still requires one of these subscriptions to operate.

When to outsource

For service providers and lean enterprises, the MSSP Portal layers multi-tenant accounts on top of APSolute Vision and DefensePro, with Operator and Service-Provider personas, per-tenant dashboards, scrubbing-diversion control and tenant-level reporting. This is the model behind Radware's SLA-backed managed DDoS service — large-scale scrubbing capacity with signatures generated in seconds. An Indian enterprise with a small night shift usually buys ERT Gold or an MSSP service; one with a mature 24x7 SOC may self-manage with EAAF and call the ERT only for surges.

Figure 4 — ERT Silver vs ERT Gold
Both are subscriptions; Gold adds the live hands-on Under Attack Service on top of everything in Silver.ERT Silver vs ERT GoldERT SilverSecurity Update ServiceERT Active Attackers FeedGeolocation feedAutomated coverage onlyERT GoldEverything in SilverERT Under Attack ServiceExperts remote into DefenseProLive signature tuning
Both are subscriptions; Gold adds the live hands-on Under Attack Service on top of everything in Silver.
Figure 5 — How an under-attack call gets mitigated
Invoking the ERT hands experts direct control of DefensePro so they can tune and write signatures live.How an under-attack call gets mitigatedInvokecall the ERT hotlineControlexperts accessDefenseProAnalyseassess the live attackTunecustom + behaviouralsigsRestoreclean traffic returns
Invoking the ERT hands experts direct control of DefensePro so they can tune and write signatures live.

Arjun Nair, network security lead at Konkan Broadband (a Pune ISP), faces this

At 2 a.m. customer circuits saturate, the upstream link is maxed and the support line floods — a volumetric multi-vector flood with DNS amplification.

Likely cause

A fresh IoT botnet is hammering customer IP ranges faster than the on-call shift can write rules by hand.

Diagnosis

In APSolute Vision the DefensePro security dashboard flags UDP/DNS floods and many attacking sources; the EAAF profile is licensed but set to Report-Only, so it is watching, not blocking.

APSolute Vision ▸ Configuration ▸ DefensePro ▸ Network Protection ▸ ERT Active Attackers Feed Profiles
Fix

Switch the EAAF profile to block mode (Tor + Web Attacker, High/Medium risk) so DefensePro pre-emptively drops known active attackers, then invoke the ERT hotline; the ERT remotes in, tunes behavioural signatures for the DNS-amplification vector and adds a custom signature.

Verify

The APSolute Vision dashboard shows attack traffic dropping and clean traffic restored, the EAAF report shows blocked sources climbing, and a follow-up report documents time-to-mitigate for the post-incident review.

Prove it from the dashboard, not a hunch

Never close a DDoS ticket on 'looks better now'. The APSolute Vision dashboard and EAAF report show real-time attack analytics, blocked sources and time-to-mitigate. That single read confirms the attack is actually down and documents the incident for review.

Quick check · Q4 of 10 · Analyze

An interviewer asks the difference between ERT Silver and ERT Gold. Best answer?

Correct: c. Silver bundles the Security Update Service, the Active Attackers Feed and Geolocation. Gold adds the ERT Under Attack Service — experts remoting into DefensePro for live mitigation.
👉 So far: Packages: EAAF standalone, ERT Silver (SUS + EAAF + Geolocation), ERT Gold (Silver + Under Attack Service). The MSSP Portal adds multi-tenancy for SLA-backed managed DDoS service.

🤖 Ask the AI Tutor

Tap any question — instant, scoped to this lesson. No login, no waiting.

Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.

📝 Wrap-up assessment — six more

You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.

Q5 · Remember

Which device does the ERT take direct control of during mitigation?

Correct: c. On invocation, ERT experts gain direct control of the customer's DefensePro to assess the attack, tune behavioural features and add custom signatures. DefensePro is the inline mitigation device.
Q6 · Understand

EAAF is mainly designed to do what?

Correct: a. The ERT Active Attackers Feed is a real-time list of currently-active attackers pushed about every 15 minutes so DefensePro can block them pre-emptively — before an attack against you begins.
Q7 · Apply

You want to preview which attackers EAAF would block before enforcing. Which setting?

Correct: c. Report-Only mode logs the would-be blocks per category and risk level without enforcing, so you can confirm there is no collateral damage before flipping to active block mode.
Q8 · Analyze

Which is NOT centrally managed by APSolute Vision?

Correct: d. APSolute Vision manages the Radware portfolio — DefensePro, Alteon and AppWall — up to 1,000 devices. It does not manage arbitrary third-party gear like a Cisco router.
Q9 · Evaluate

A lean enterprise with only a small night shift faces frequent DDoS surges. Best Radware option?

Correct: c. A small night shift cannot out-tune a fresh multi-vector botnet alone. ERT Gold (Under Attack Service) or an MSSP managed service gives 24x7 hands-on mitigation and SLA-backed coverage.
Q10 · Evaluate

How does APSolute Vision authenticate RBAC users?

Correct: a. APSolute Vision RBAC scopes granular roles to device groups and authenticates users via a local server or RADIUS — the standard enterprise options for centralized access control.
Lesson complete — saved to your profile.
Almost! You need 70% (7 of 10) — re-read the path that tripped you up and tap "Try again".

🧠 In your own words

Type one line: why is Radware DDoS defense called 'people plus platform' rather than 'an appliance'? Then compare with the expert version.

Expert version: Because the defense lives in two layers that work together. The platform layer — DefensePro fed by the ~15-minute EAAF and run from the APSolute Vision console — handles the known and the fast automatically. The people layer — the 24x7 Emergency Response Team backed by Radware's SOC — handles the novel: experts remote into your DefensePro to analyse a live multi-vector attack, tune behavioural signatures and write custom ones. No single appliance can both auto-block at scale and improvise against a brand-new vector, which is exactly why Radware sells a team and a console, packages them as ERT Silver/Gold, and offers the MSSP Portal for fully managed, SLA-backed protection.

🗣 Teach a friend

Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.

📖 Glossary

Emergency Response Team (ERT)
Radware's 24x7 experts who take direct control of DefensePro during an attack to analyse, tune and write custom signatures.
ERT Active Attackers Feed (EAAF)
Real-time feed of currently-active DDoS attackers pushed to DefensePro about every 15 minutes for pre-emptive blocking.
APSolute Vision
Centralized console to configure, monitor and report on DefensePro, Alteon and AppWall across up to 1,000 devices.
DefensePro
Radware's inline, real-time DDoS/DoS mitigation device that the ERT controls and that consumes EAAF and SUS updates.
Security Update Service (SUS)
Subscription delivering ongoing signature and threat updates to DefensePro, backing the ERT and EAAF.
Report-Only mode
EAAF setting that logs would-be blocks per category and risk level without enforcing, used for safe tuning.
RBAC
Role-based access control in APSolute Vision; granular roles scoped to device groups, authenticated by local server or RADIUS.
MSSP Portal
Multi-tenant overlay on APSolute Vision and DefensePro letting service providers offer managed, SLA-backed DDoS protection.
Multi-vector attack
A DDoS that combines several techniques at once, such as a volumetric flood with DNS amplification.

📚 Sources

  1. Radware — DDoS Attack Mitigation Service | Emergency Response Team (ERT). radware.com
  2. Radware — Emergency Response Team (ERT) / CERT — Application Security. radware.com
  3. Radware — ERT Active Attackers Feed Data Sheet. radware.com
  4. Radware — ERT Active Attackers Feed Profiles (DefensePro Release Notes). portals.radware.com
  5. Radware — APSolute Vision: Management & Monitoring Tool. radware.com
  6. Radware — MSSP Portal: Your DDoS Detection and Mitigation Solution. radware.com

What's next?

Got the people-plus-platform model? Next, go deep on DefensePro itself — behavioural detection, the signature engine, and how it tells a flash crowd apart from a volumetric flood in real time.

Next · All interview lessons → Practice on exam.techclick.in →