Cost Protection Mechanism in DDR

When automated processes or large-scale copy operations generate a surge of events for an asset, these peaks can sometimes result in millions of events within a short period. This can lead to increased costs for forwarding these events via EventBridge for DDR (Data Detection and Response) monitoring.

To manage this, the DDR cost protection mechanism automatically suspends event collection for the affected asset for two days. After this period, DDR will resume monitoring the asset.

An indicator will appear on the Events and Active Identities tabs to show which assets have had monitoring disabled due to cost protection.

Contact Support if you need to re-enable an asset before the end of the suspension period or if you want to disable cost protection entirely.