What are the limitations of automated DDoS detection systems in tracing attacks?

Automated DDoS detection systems are excellent at identifying and mitigating attacks in real-time. However, their primary focus is on defense, not attribution. While they can log source IPs and traffic patterns, they typically lack the deep forensic capabilities and access to broader network infrastructure data required for definitive tracing and attribution, which often necessitates manual investigation and external collaboration.