Hi @bqt.ctt,
Every attack has different patterns of behavior, and to protect your site you’d have to try to figure out what patterns may be limited or blocked by which Cloudflare tool.
You would increase your chances of getting meaningful suggestions from volunteers in this community if you could share a sample of your origin server access logs, so that we can have a look and perhaps suggest the most appropriate tools to use. Please obfuscate any references about your domain and server IP address before posting.
Alternatively, reading a recent thread about a DDOS where many tools were discussed may perhaps help you with some ideas.