API Reference

Radar

Attacks

Layer3

Timeseries Groups

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Get layer 3 attacks by vector time series

Deprecated: Use [Radar Attacks Layer 3 Timeseries Groups By Dimension](https://developers.cloudflare.com/api/resources/radar/subresources/attacks/subresources/layer3/methods/timeseries_groups_v2/) instead.

client.Radar.Attacks.Layer3.TimeseriesGroups.Vector(ctx, query) (*AttackLayer3TimeseriesGroupVectorResponse, error)

GET/radar/attacks/layer3/timeseries_groups/vector

Retrieves the distribution of layer 3 attacks by vector over time.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

User Details WriteUser Details Read

ParametersExpand Collapse

query AttackLayer3TimeseriesGroupVectorParams

AggInterval param.Field[AttackLayer3TimeseriesGroupVectorParamsAggInterval]Optional

Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals.

const AttackLayer3TimeseriesGroupVectorParamsAggInterval15m AttackLayer3TimeseriesGroupVectorParamsAggInterval = "15m"

const AttackLayer3TimeseriesGroupVectorParamsAggInterval1h AttackLayer3TimeseriesGroupVectorParamsAggInterval = "1h"

const AttackLayer3TimeseriesGroupVectorParamsAggInterval1d AttackLayer3TimeseriesGroupVectorParamsAggInterval = "1d"

const AttackLayer3TimeseriesGroupVectorParamsAggInterval1w AttackLayer3TimeseriesGroupVectorParamsAggInterval = "1w"

Continent param.Field[[]string]Optional

Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude continents from results. For example, -EU,NA excludes results from EU, but includes results from NA.

DateEnd param.Field[[]Time]Optional

End of the date range (inclusive).

DateRange param.Field[[]string]Optional

Filters results by date range. For example, use 7d and 7dcontrol to compare this week with the previous week. Use this parameter or set specific start and end dates (dateStart and dateEnd parameters).

DateStart param.Field[[]Time]Optional

Start of the date range.

Direction param.Field[AttackLayer3TimeseriesGroupVectorParamsDirection]Optional

Specifies whether the location filter applies to the source or target location.

const AttackLayer3TimeseriesGroupVectorParamsDirectionOrigin AttackLayer3TimeseriesGroupVectorParamsDirection = "ORIGIN"

const AttackLayer3TimeseriesGroupVectorParamsDirectionTarget AttackLayer3TimeseriesGroupVectorParamsDirection = "TARGET"

Format param.Field[AttackLayer3TimeseriesGroupVectorParamsFormat]Optional

Format in which results will be returned.

const AttackLayer3TimeseriesGroupVectorParamsFormatJson AttackLayer3TimeseriesGroupVectorParamsFormat = "JSON"

const AttackLayer3TimeseriesGroupVectorParamsFormatCsv AttackLayer3TimeseriesGroupVectorParamsFormat = "CSV"

IPVersion param.Field[[]AttackLayer3TimeseriesGroupVectorParamsIPVersion]Optional

Filters results by IP version (Ipv4 vs. IPv6).

const AttackLayer3TimeseriesGroupVectorParamsIPVersionIPv4 AttackLayer3TimeseriesGroupVectorParamsIPVersion = "IPv4"

const AttackLayer3TimeseriesGroupVectorParamsIPVersionIPv6 AttackLayer3TimeseriesGroupVectorParamsIPVersion = "IPv6"

LimitPerGroup param.Field[int64]Optional

Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an “other” category.

Location param.Field[[]string]Optional

Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude locations from results. For example, -US,PT excludes results from the US, but includes results from PT.

Name param.Field[[]string]Optional

Array of names used to label the series in the response.

Normalization param.Field[AttackLayer3TimeseriesGroupVectorParamsNormalization]Optional

Normalization method applied to the results. Refer to Normalization methods.

const AttackLayer3TimeseriesGroupVectorParamsNormalizationPercentage AttackLayer3TimeseriesGroupVectorParamsNormalization = "PERCENTAGE"

const AttackLayer3TimeseriesGroupVectorParamsNormalizationMin0Max AttackLayer3TimeseriesGroupVectorParamsNormalization = "MIN0_MAX"

Protocol param.Field[[]AttackLayer3TimeseriesGroupVectorParamsProtocol]Optional

Filters the results by layer 3/4 protocol.

const AttackLayer3TimeseriesGroupVectorParamsProtocolUdp AttackLayer3TimeseriesGroupVectorParamsProtocol = "UDP"

const AttackLayer3TimeseriesGroupVectorParamsProtocolTCP AttackLayer3TimeseriesGroupVectorParamsProtocol = "TCP"

const AttackLayer3TimeseriesGroupVectorParamsProtocolIcmp AttackLayer3TimeseriesGroupVectorParamsProtocol = "ICMP"

const AttackLayer3TimeseriesGroupVectorParamsProtocolGRE AttackLayer3TimeseriesGroupVectorParamsProtocol = "GRE"

ReturnsExpand Collapse

type AttackLayer3TimeseriesGroupVectorResponse struct{…}

Meta AttackLayer3TimeseriesGroupVectorResponseMeta

Metadata for the results.

AggInterval AttackLayer3TimeseriesGroupVectorResponseMetaAggInterval

Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals.

One of the following:

const AttackLayer3TimeseriesGroupVectorResponseMetaAggIntervalFifteenMinutes AttackLayer3TimeseriesGroupVectorResponseMetaAggInterval = "FIFTEEN_MINUTES"

const AttackLayer3TimeseriesGroupVectorResponseMetaAggIntervalOneHour AttackLayer3TimeseriesGroupVectorResponseMetaAggInterval = "ONE_HOUR"

const AttackLayer3TimeseriesGroupVectorResponseMetaAggIntervalOneDay AttackLayer3TimeseriesGroupVectorResponseMetaAggInterval = "ONE_DAY"

const AttackLayer3TimeseriesGroupVectorResponseMetaAggIntervalOneWeek AttackLayer3TimeseriesGroupVectorResponseMetaAggInterval = "ONE_WEEK"

const AttackLayer3TimeseriesGroupVectorResponseMetaAggIntervalOneMonth AttackLayer3TimeseriesGroupVectorResponseMetaAggInterval = "ONE_MONTH"

ConfidenceInfo AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfo

Annotations []AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotation

DataSource AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource

Data source for annotations.

One of the following:

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceAll AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "ALL"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceAIBots AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "AI_BOTS"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceAIGateway AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "AI_GATEWAY"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceBGP AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "BGP"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceBots AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "BOTS"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceConnectionAnomaly AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "CONNECTION_ANOMALY"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceCT AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "CT"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceDNS AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "DNS"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceDNSMagnitude AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "DNS_MAGNITUDE"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceDNSAS112 AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "DNS_AS112"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceDos AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "DOS"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceEmailRouting AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "EMAIL_ROUTING"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceEmailSecurity AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "EMAIL_SECURITY"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceFw AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "FW"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceFwPg AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "FW_PG"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceHTTP AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceHTTPControl AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_CONTROL"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceHTTPCrawlerReferer AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_CRAWLER_REFERER"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceHTTPOrigins AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_ORIGINS"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceIQI AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "IQI"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceLeakedCredentials AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "LEAKED_CREDENTIALS"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceNet AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "NET"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceRobotsTXT AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "ROBOTS_TXT"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceSpeed AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "SPEED"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSourceWorkersAI AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsDataSource = "WORKERS_AI"

Description string

EndDate Time

formatdate-time

EventType AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventType

Event type for annotations.

One of the following:

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventTypeEvent AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventType = "EVENT"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventTypeGeneral AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventType = "GENERAL"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventTypeOutage AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventType = "OUTAGE"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventTypePartialProjection AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventType = "PARTIAL_PROJECTION"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventTypePipeline AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventType = "PIPELINE"

const AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventTypeTrafficAnomaly AttackLayer3TimeseriesGroupVectorResponseMetaConfidenceInfoAnnotationsEventType = "TRAFFIC_ANOMALY"

IsInstantaneous bool

Whether event is a single point in time or a time range.

LinkedURL string

formaturi

StartDate Time

formatdate-time

Level int64

Provides an indication of how much confidence Cloudflare has in the data.

DateRange []AttackLayer3TimeseriesGroupVectorResponseMetaDateRange

EndTime Time

Adjusted end of date range.

formatdate-time

StartTime Time

Adjusted start of date range.

formatdate-time

LastUpdated Time

Timestamp of the last dataset update.

formatdate-time

Normalization AttackLayer3TimeseriesGroupVectorResponseMetaNormalization

Normalization method applied to the results. Refer to Normalization methods.

One of the following:

const AttackLayer3TimeseriesGroupVectorResponseMetaNormalizationPercentage AttackLayer3TimeseriesGroupVectorResponseMetaNormalization = "PERCENTAGE"

const AttackLayer3TimeseriesGroupVectorResponseMetaNormalizationMin0Max AttackLayer3TimeseriesGroupVectorResponseMetaNormalization = "MIN0_MAX"

const AttackLayer3TimeseriesGroupVectorResponseMetaNormalizationMinMax AttackLayer3TimeseriesGroupVectorResponseMetaNormalization = "MIN_MAX"

const AttackLayer3TimeseriesGroupVectorResponseMetaNormalizationRawValues AttackLayer3TimeseriesGroupVectorResponseMetaNormalization = "RAW_VALUES"

const AttackLayer3TimeseriesGroupVectorResponseMetaNormalizationPercentageChange AttackLayer3TimeseriesGroupVectorResponseMetaNormalization = "PERCENTAGE_CHANGE"

const AttackLayer3TimeseriesGroupVectorResponseMetaNormalizationRollingAverage AttackLayer3TimeseriesGroupVectorResponseMetaNormalization = "ROLLING_AVERAGE"

const AttackLayer3TimeseriesGroupVectorResponseMetaNormalizationOverlappedPercentage AttackLayer3TimeseriesGroupVectorResponseMetaNormalization = "OVERLAPPED_PERCENTAGE"

const AttackLayer3TimeseriesGroupVectorResponseMetaNormalizationRatio AttackLayer3TimeseriesGroupVectorResponseMetaNormalization = "RATIO"

Units []AttackLayer3TimeseriesGroupVectorResponseMetaUnit

Measurement units for the results.

Name string

Value string

Serie0 AttackLayer3TimeseriesGroupVectorResponseSerie0

Timestamps []Time

Get layer 3 attacks by vector time series

Go

HTTP

TypeScript

Python

Go

Terraform

package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/option"
  "github.com/cloudflare/cloudflare-go/radar"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.Radar.Attacks.Layer3.TimeseriesGroups.Vector(context.TODO(), radar.AttackLayer3TimeseriesGroupVectorParams{

  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.Meta)
}

200 example

{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z"
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}

Returns Examples

200 example

{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z"
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}