Skip to content
Cloudflare API
Start here
API Reference
Radar
Attacks
Layer7
Top
Ases

Get top origin ASes of layer 7 attacks

radar.attacks.layer7.top.ases.origin(AseOriginParams**kwargs) -> AseOriginResponse
GET/radar/attacks/layer7/top/ases/origin

Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
User Details WriteUser Details Read
ParametersExpand Collapse
continent: Optional[SequenceNotStr[str]]

Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude continents from results. For example, -EU,NA excludes results from EU, but includes results from NA.

date_end: Optional[SequenceNotStr[Union[str, datetime]]]

End of the date range (inclusive).

date_range: Optional[SequenceNotStr[str]]

Filters results by date range. For example, use 7d and 7dcontrol to compare this week with the previous week. Use this parameter or set specific start and end dates (dateStart and dateEnd parameters).

date_start: Optional[SequenceNotStr[Union[str, datetime]]]

Start of the date range.

format: Optional[Literal["JSON", "CSV"]]

Format in which results will be returned.

One of the following:
"JSON"
"CSV"
http_method: Optional[List[Literal["GET", "POST", "DELETE", 43 more]]]

Filters results by HTTP method.

One of the following:
"GET"
"POST"
"DELETE"
"PUT"
"HEAD"
"PURGE"
"OPTIONS"
"PROPFIND"
"MKCOL"
"PATCH"
"ACL"
"BCOPY"
"BDELETE"
"BMOVE"
"BPROPFIND"
"BPROPPATCH"
"CHECKIN"
"CHECKOUT"
"CONNECT"
"COPY"
"LABEL"
"LOCK"
"MERGE"
"MKACTIVITY"
"MKWORKSPACE"
"MOVE"
"NOTIFY"
"ORDERPATCH"
"POLL"
"PROPPATCH"
"REPORT"
"SEARCH"
"SUBSCRIBE"
"TRACE"
"UNCHECKOUT"
"UNLOCK"
"UNSUBSCRIBE"
"UPDATE"
"VERSIONCONTROL"
"BASELINECONTROL"
"XMSENUMATTS"
"RPC_OUT_DATA"
"RPC_IN_DATA"
"JSON"
"COOK"
"TRACK"
http_version: Optional[List[Literal["HTTPv1", "HTTPv2", "HTTPv3"]]]

Filters results by HTTP version.

One of the following:
"HTTPv1"
"HTTPv2"
"HTTPv3"
ip_version: Optional[List[Literal["IPv4", "IPv6"]]]

Filters results by IP version (Ipv4 vs. IPv6).

One of the following:
"IPv4"
"IPv6"
limit: Optional[int]

Limits the number of objects returned in the response.

exclusiveMinimum
minimum0
location: Optional[SequenceNotStr[str]]

Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude locations from results. For example, -US,PT excludes results from the US, but includes results from PT.

mitigation_product: Optional[List[Literal["DDOS", "WAF", "BOT_MANAGEMENT", 4 more]]]

Filters the results by layer 7 mitigation product.

One of the following:
"DDOS"
"WAF"
"BOT_MANAGEMENT"
"ACCESS_RULES"
"IP_REPUTATION"
"API_SHIELD"
"DATA_LOSS_PREVENTION"
name: Optional[SequenceNotStr[str]]

Array of names used to label the series in the response.

ReturnsExpand Collapse
class AseOriginResponse: …
meta: Meta

Metadata for the results.

confidence_info: Optional[MetaConfidenceInfo]
annotations: List[MetaConfidenceInfoAnnotation]
data_source: Literal["ALL", "AI_BOTS", "AI_GATEWAY", 22 more]

Data source for annotations.

One of the following:
"ALL"
"AI_BOTS"
"AI_GATEWAY"
"BGP"
"BOTS"
"CONNECTION_ANOMALY"
"CT"
"DNS"
"DNS_MAGNITUDE"
"DNS_AS112"
"DOS"
"EMAIL_ROUTING"
"EMAIL_SECURITY"
"FW"
"FW_PG"
"HTTP"
"HTTP_CONTROL"
"HTTP_CRAWLER_REFERER"
"HTTP_ORIGINS"
"IQI"
"LEAKED_CREDENTIALS"
"NET"
"ROBOTS_TXT"
"SPEED"
"WORKERS_AI"
description: str
end_date: datetime
formatdate-time
event_type: Literal["EVENT", "GENERAL", "OUTAGE", 3 more]

Event type for annotations.

One of the following:
"EVENT"
"GENERAL"
"OUTAGE"
"PARTIAL_PROJECTION"
"PIPELINE"
"TRAFFIC_ANOMALY"
is_instantaneous: bool

Whether event is a single point in time or a time range.

linked_url: str
formaturi
start_date: datetime
formatdate-time
level: int

Provides an indication of how much confidence Cloudflare has in the data.

date_range: List[MetaDateRange]
end_time: datetime

Adjusted end of date range.

formatdate-time
start_time: datetime

Adjusted start of date range.

formatdate-time
last_updated: datetime

Timestamp of the last dataset update.

formatdate-time
normalization: Literal["PERCENTAGE", "MIN0_MAX", "MIN_MAX", 5 more]

Normalization method applied to the results. Refer to Normalization methods.

One of the following:
"PERCENTAGE"
"MIN0_MAX"
"MIN_MAX"
"RAW_VALUES"
"PERCENTAGE_CHANGE"
"ROLLING_AVERAGE"
"OVERLAPPED_PERCENTAGE"
"RATIO"
units: List[MetaUnit]

Measurement units for the results.

name: str
value: str
top_0: List[Top0]
origin_asn: str
origin_asn_name: str
rank: float
value: str

Get top origin ASes of layer 7 attacks

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
response = client.radar.attacks.layer7.top.ases.origin()
print(response.meta)
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z"
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "top_0": [
      {
        "originAsn": "55836",
        "originAsnName": "RELIANCEJIO-IN Reliance Jio Infocomm Limited",
        "rank": 1,
        "value": "4.323214"
      }
    ]
  },
  "success": true
}
Returns Examples
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z"
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "top_0": [
      {
        "originAsn": "55836",
        "originAsnName": "RELIANCEJIO-IN Reliance Jio Infocomm Limited",
        "rank": 1,
        "value": "4.323214"
      }
    ]
  },
  "success": true
}