API Reference

Radar

Attacks

Layer3

Timeseries Groups

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Get layer 3 attacks by protocol time series

Deprecated: Use [Radar Attacks Layer 3 Timeseries Groups By Dimension](https://developers.cloudflare.com/api/resources/radar/subresources/attacks/subresources/layer3/methods/timeseries_groups_v2/) instead.

client.Radar.Attacks.Layer3.TimeseriesGroups.Protocol(ctx, query) (*AttackLayer3TimeseriesGroupProtocolResponse, error)

GET/radar/attacks/layer3/timeseries_groups/protocol

Retrieves the distribution of layer 3 attacks by protocol over time.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

User Details WriteUser Details Read

ParametersExpand Collapse

query AttackLayer3TimeseriesGroupProtocolParams

AggInterval param.Field[AttackLayer3TimeseriesGroupProtocolParamsAggInterval]Optional

Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals.

const AttackLayer3TimeseriesGroupProtocolParamsAggInterval15m AttackLayer3TimeseriesGroupProtocolParamsAggInterval = "15m"

const AttackLayer3TimeseriesGroupProtocolParamsAggInterval1h AttackLayer3TimeseriesGroupProtocolParamsAggInterval = "1h"

const AttackLayer3TimeseriesGroupProtocolParamsAggInterval1d AttackLayer3TimeseriesGroupProtocolParamsAggInterval = "1d"

const AttackLayer3TimeseriesGroupProtocolParamsAggInterval1w AttackLayer3TimeseriesGroupProtocolParamsAggInterval = "1w"

Continent param.Field[[]string]Optional

Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude continents from results. For example, -EU,NA excludes results from EU, but includes results from NA.

DateEnd param.Field[[]Time]Optional

End of the date range (inclusive).

DateRange param.Field[[]string]Optional

Filters results by date range. For example, use 7d and 7dcontrol to compare this week with the previous week. Use this parameter or set specific start and end dates (dateStart and dateEnd parameters).

DateStart param.Field[[]Time]Optional

Start of the date range.

Direction param.Field[AttackLayer3TimeseriesGroupProtocolParamsDirection]Optional

Specifies whether the location filter applies to the source or target location.

const AttackLayer3TimeseriesGroupProtocolParamsDirectionOrigin AttackLayer3TimeseriesGroupProtocolParamsDirection = "ORIGIN"

const AttackLayer3TimeseriesGroupProtocolParamsDirectionTarget AttackLayer3TimeseriesGroupProtocolParamsDirection = "TARGET"

Format param.Field[AttackLayer3TimeseriesGroupProtocolParamsFormat]Optional

Format in which results will be returned.

const AttackLayer3TimeseriesGroupProtocolParamsFormatJson AttackLayer3TimeseriesGroupProtocolParamsFormat = "JSON"

const AttackLayer3TimeseriesGroupProtocolParamsFormatCsv AttackLayer3TimeseriesGroupProtocolParamsFormat = "CSV"

IPVersion param.Field[[]AttackLayer3TimeseriesGroupProtocolParamsIPVersion]Optional

Filters results by IP version (Ipv4 vs. IPv6).

const AttackLayer3TimeseriesGroupProtocolParamsIPVersionIPv4 AttackLayer3TimeseriesGroupProtocolParamsIPVersion = "IPv4"

const AttackLayer3TimeseriesGroupProtocolParamsIPVersionIPv6 AttackLayer3TimeseriesGroupProtocolParamsIPVersion = "IPv6"

Location param.Field[[]string]Optional

Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude locations from results. For example, -US,PT excludes results from the US, but includes results from PT.

Name param.Field[[]string]Optional

Array of names used to label the series in the response.

Normalization param.Field[AttackLayer3TimeseriesGroupProtocolParamsNormalization]Optional

Normalization method applied to the results. Refer to Normalization methods.

const AttackLayer3TimeseriesGroupProtocolParamsNormalizationPercentage AttackLayer3TimeseriesGroupProtocolParamsNormalization = "PERCENTAGE"

const AttackLayer3TimeseriesGroupProtocolParamsNormalizationMin0Max AttackLayer3TimeseriesGroupProtocolParamsNormalization = "MIN0_MAX"

ReturnsExpand Collapse

type AttackLayer3TimeseriesGroupProtocolResponse struct{…}

Meta AttackLayer3TimeseriesGroupProtocolResponseMeta

Metadata for the results.

AggInterval AttackLayer3TimeseriesGroupProtocolResponseMetaAggInterval

Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals.

One of the following:

const AttackLayer3TimeseriesGroupProtocolResponseMetaAggIntervalFifteenMinutes AttackLayer3TimeseriesGroupProtocolResponseMetaAggInterval = "FIFTEEN_MINUTES"

const AttackLayer3TimeseriesGroupProtocolResponseMetaAggIntervalOneHour AttackLayer3TimeseriesGroupProtocolResponseMetaAggInterval = "ONE_HOUR"

const AttackLayer3TimeseriesGroupProtocolResponseMetaAggIntervalOneDay AttackLayer3TimeseriesGroupProtocolResponseMetaAggInterval = "ONE_DAY"

const AttackLayer3TimeseriesGroupProtocolResponseMetaAggIntervalOneWeek AttackLayer3TimeseriesGroupProtocolResponseMetaAggInterval = "ONE_WEEK"

const AttackLayer3TimeseriesGroupProtocolResponseMetaAggIntervalOneMonth AttackLayer3TimeseriesGroupProtocolResponseMetaAggInterval = "ONE_MONTH"

ConfidenceInfo AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfo

Annotations []AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotation

DataSource AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource

Data source for annotations.

One of the following:

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceAll AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "ALL"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceAIBots AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "AI_BOTS"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceAIGateway AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "AI_GATEWAY"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceBGP AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "BGP"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceBots AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "BOTS"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceConnectionAnomaly AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "CONNECTION_ANOMALY"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceCT AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "CT"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceDNS AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "DNS"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceDNSMagnitude AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "DNS_MAGNITUDE"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceDNSAS112 AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "DNS_AS112"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceDos AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "DOS"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceEmailRouting AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "EMAIL_ROUTING"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceEmailSecurity AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "EMAIL_SECURITY"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceFw AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "FW"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceFwPg AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "FW_PG"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceHTTP AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceHTTPControl AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_CONTROL"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceHTTPCrawlerReferer AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_CRAWLER_REFERER"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceHTTPOrigins AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_ORIGINS"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceIQI AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "IQI"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceLeakedCredentials AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "LEAKED_CREDENTIALS"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceNet AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "NET"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceRobotsTXT AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "ROBOTS_TXT"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceSpeed AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "SPEED"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSourceWorkersAI AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsDataSource = "WORKERS_AI"

Description string

EndDate Time

formatdate-time

EventType AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventType

Event type for annotations.

One of the following:

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventTypeEvent AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventType = "EVENT"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventTypeGeneral AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventType = "GENERAL"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventTypeOutage AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventType = "OUTAGE"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventTypePartialProjection AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventType = "PARTIAL_PROJECTION"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventTypePipeline AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventType = "PIPELINE"

const AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventTypeTrafficAnomaly AttackLayer3TimeseriesGroupProtocolResponseMetaConfidenceInfoAnnotationsEventType = "TRAFFIC_ANOMALY"

IsInstantaneous bool

Whether event is a single point in time or a time range.

LinkedURL string

formaturi

StartDate Time

formatdate-time

Level int64

Provides an indication of how much confidence Cloudflare has in the data.

DateRange []AttackLayer3TimeseriesGroupProtocolResponseMetaDateRange

EndTime Time

Adjusted end of date range.

formatdate-time

StartTime Time

Adjusted start of date range.

formatdate-time

LastUpdated Time

Timestamp of the last dataset update.

formatdate-time

Normalization AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization

Normalization method applied to the results. Refer to Normalization methods.

One of the following:

const AttackLayer3TimeseriesGroupProtocolResponseMetaNormalizationPercentage AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization = "PERCENTAGE"

const AttackLayer3TimeseriesGroupProtocolResponseMetaNormalizationMin0Max AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization = "MIN0_MAX"

const AttackLayer3TimeseriesGroupProtocolResponseMetaNormalizationMinMax AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization = "MIN_MAX"

const AttackLayer3TimeseriesGroupProtocolResponseMetaNormalizationRawValues AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization = "RAW_VALUES"

const AttackLayer3TimeseriesGroupProtocolResponseMetaNormalizationPercentageChange AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization = "PERCENTAGE_CHANGE"

const AttackLayer3TimeseriesGroupProtocolResponseMetaNormalizationRollingAverage AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization = "ROLLING_AVERAGE"

const AttackLayer3TimeseriesGroupProtocolResponseMetaNormalizationOverlappedPercentage AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization = "OVERLAPPED_PERCENTAGE"

const AttackLayer3TimeseriesGroupProtocolResponseMetaNormalizationRatio AttackLayer3TimeseriesGroupProtocolResponseMetaNormalization = "RATIO"

Units []AttackLayer3TimeseriesGroupProtocolResponseMetaUnit

Measurement units for the results.

Name string

Value string

Serie0 AttackLayer3TimeseriesGroupProtocolResponseSerie0

GRE []string

Icmp []string

TCP []string

Timestamps []Time

Udp []string

Get layer 3 attacks by protocol time series

Go

HTTP

TypeScript

Python

Go

Terraform

package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/option"
  "github.com/cloudflare/cloudflare-go/radar"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.Radar.Attacks.Layer3.TimeseriesGroups.Protocol(context.TODO(), radar.AttackLayer3TimeseriesGroupProtocolParams{

  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.Meta)
}

200 example

{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z"
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "GRE": [
        "10"
      ],
      "ICMP": [
        "10"
      ],
      "TCP": [
        "10"
      ],
      "timestamps": [
        "2019-12-27T18:11:19.117Z"
      ],
      "UDP": [
        "10"
      ]
    }
  },
  "success": true
}

Returns Examples

200 example

{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z"
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "GRE": [
        "10"
      ],
      "ICMP": [
        "10"
      ],
      "TCP": [
        "10"
      ],
      "timestamps": [
        "2019-12-27T18:11:19.117Z"
      ],
      "UDP": [
        "10"
      ]
    }
  },
  "success": true
}