DDoS protection with APM module

Hi,

I’m hoping someone can help point me in the right direction regarding an issue we’re facing.

Our main website has been experiencing increasingly frequent DDoS attacks, which currently require manual intervention to mitigate.

Typically, our site handles around 2,000 concurrent connections, but during an attack, this spikes to over 140,000 connections. As a result, our backend servers are overwhelmed and subsequently fail.

We’ve found that enabling an APM click-through page effectively prevents these attacks from reaching the backend servers. However, we currently have to enable this manually via the Virtual Server (VS) settings.

My question is:
Is it possible to write an iRule that automatically enables the APM page if the concurrent connections to the VS exceed 3,000, and then disables it once the connections drop below 3,000?

For reference, I’ve attached the basic APM policy we currently use.

Thank you in advance for any guidance you can provide!