Ask about the data — e.g. “how many nodes are there?”,
“show connections with the most DDoS traffic”, “which host has the most half-open
connections?”, “what signals can I combine to detect a SYN flood?”. Select a region
first to scope your question.