The Incapsula external monitoring feature uses the NetFlow protocol, developed by Cisco and widely supported by router and firewall vendors, to obtain information from your network environment. Once configured, your router pushes data at regular intervals to the Incapsula Behemoth scrubbing servers. The Behemoth scrubbers then thoroughly analyze it for signs of DDoS attacks, using the resultant data to populate your Incapsula dashboard.
When Incapsula determines that a monitored network environment is under attack, the system triggers a series of events to notify you that it's time to activate our on-demand infrastructure protection service. Your notifications can be received via email, text message, and/or phone call. You also have the option to predefine additional recipients and choose how each should be notified, in accordance with your organization's escalation path. Customers can also customize their escalation paths to have Incapsula auto-notify members on different teams, while also designating backup contact. Doing so ensures that all parties are coordinated in providing organization-wide response to an incoming DDoS threat.