Mikrotik-RouterOS-automatic-backup-and-update VS FastNetMon

A nice script to have is one that notifies you about updates, and if you set them to it even installs them and backups your configuration. Have a look at this one, which can do these things: https://github.com/beeyev/Mikrotik-RouterOS-automatic-backup-and-update

You can try this github https://github.com/beeyev/Mikrotik-RouterOS-automatic-backup-and-update

If you have a BGP peering with you ISP/upstream provider, ask them if they have a blackhole community you can broadcast to. Usually they are ASN:666. The only downside is you would only be able to advertise your IP address to that, essentially killing your internet (if that's your only IP) as long as the block is up. We usually set our filter to 15 minutes and most attackers give up after that. At this level, you probably would have your own ASN with a small range and could potentially use something like FastNetMon (https://fastnetmon.com) to automatically advertise and remove IPs from the community.

Have you looked at fastnetmon ? It's freemium and It looks like the commercial version would work you, but I think the community edition is aslo worth a look. It's primary function is to detect DDOS attacks, but it can export data in ways that might be useful to you.

To mitigate DoS attacks means you need information - preferably before the users start screaming. Running sampling on your edge router with something like Fastnetmon will give you alerting of a probable DDoS attack before it becomes a significant problem.

notify_about_attack.sh https://github.com/pavel-odintsov/fastnetmon/blob/master/src/notify_about_attack.sh