The fight against DDoS attacks continues, with assaults occurring every day

Hello, yesterday I received another DDoS attack, with nearly two million different IPs. The cloud stopped it, so they say, but my website still went offline. Therefore, I have some questions for you. In the activity log, it shows the time of the attack.
First question, does the blue line in the picture indicate that the IPs were blocked? So, does ‘blocked’ mean that they didn’t reach my server? Because my server went offline, if in the picture, it blocked the attack, how did it reach my server?
–Ho usato il comando netstat -tn | awk ‘$4 ~ /:3[0-9]{4}$/ || $4 ~ /:4[0-9]{4}$/ || $4 ~ /:5[0-9]{4}$/’ | awk ‘{print $5 “:” $4}’
e ieri mi vedevo centinaia di ip collegati a delle porte chiuse del mio server

My website is heavily fortified, so why did it still go offline? Can someone enlighten me? Thanks. My server has 8 cores and 36 GB of RAM.