**Introducing a new console experience for Amazon WAF**

You can now use the updated experience to access Amazon WAF functionality anywhere in the console. For more details, see [Working with the console](https://docs.amazonaws.cn/waf/latest/developerguide/working-with-console.html). 

# How Amazon Shield detects events
<a name="ddos-event-detection"></a>

Amazon operates service-level detection systems for the Amazon network and individual Amazon services, to ensure that they remain available during a DDoS attack. Additionally, resource-level detection systems monitor each individual Amazon resource to ensure that traffic toward the resource remains within expected parameters. This combination protects both the targeted Amazon resource and Amazon services, by applying mitigations that drop known bad packets, highlight potentially malicious traffic, and prioritize traffic from end users.

Detected events appear in your Shield Advanced event summaries, attack details, and Amazon CloudWatch metrics as either the name of the DDoS attack vector or as `Volumetric` if the evaluation was based on traffic volume instead of signature. For more information on the attack vector dimensions that are available within the `DDoSDetected` CloudWatch metric, see [Amazon Shield Advanced metrics](shield-metrics.md).

**Topics**
+ [Amazon Shield detection logic for infrastructure layer threats (layer 3 and layer 4)](ddos-event-detection-infrastructure.md)
+ [Shield Advanced detection logic for application layer threats (layer 7)](ddos-event-detection-application.md)
+ [Shield Advanced detection logic for multiple resources in an application](ddos-event-detection-multiple-resources.md)