Slowloris connection-exhaustion attack

Your web tier starts refusing connections and health checks fail, but CPU, memory, and bandwidth are all low, nothing looks busy. The connection-count dashboard shows worker/connection pools maxed out: thousands of open connections each sending HTTP headers extremely slowly (a byte every few seconds) and never completing the request. Traffic volume in bytes/sec is tiny. It comes from a few hundred IPs. There was no deploy. How do you triage and mitigate this low-bandwidth connection-exhaustion attack?