Firewall Analytics — Free plan
Adjusting displayed data
You can apply multiple filters and exclusions to narrow the scope of Firewall Analytics, as well as adjust the report duration. Modifying the duration, filters, or exclusions affects the analytics data displayed in the Activity Log.
You can adjust the scope of analytics by manually entering filter conditions. Alternatively, click the Filter or Exclude buttons that appear when hovering over analytics data legend to filter by that field value.
To manually add a filter:
- Click Add filter under Firewall Events.
- Select a field, an operator, and a value. For example, to filter events by IP address, select IP for Action, select equals for the operator, and enter the IP address.
- Click Apply.
Take the following into account when entering filter values:
- Do not add quotes around values.
- Do not enter the
ASprefix when entering ASN numbers. For example, enter
- Wildcards are not supported.
Adjust report duration
To adjust report duration, select the desired duration from the dropdown in Firewall Events.
Create Firewall Rule from current filters
The Activity log summarizes Firewall events by date to show the action taken and the applied Cloudflare security feature.
Firewall Events are shown by individual event rather than by request. For example, if a single request triggers three different Firewall features, the Firewall Events will show three individual events in the Activity log.
Expand each event to see its details, and define filters and exclusions based on the event's field values. Click the Filter or Exclude button when hovering a field to add the field value to the filters or exclusions list of the displayed analytics. To download the event data in JSON format, click Export event JSON.
To configure the columns displayed in the Activity log, click Edit columns. This gives you flexibility depending on the type of analysis that you need to perform.
For example, if you are diagnosing a bot-related issue, you may want to see the User agent and the Country columns. On the other hand, if you are trying to identify a DDoS attack, you may want to see IP address, ASN, and Path columns.
When the Connection Close action appears in the Activity Log, it means the existing request is unaffected, but the client is instructed to establish a new connection instead of reusing the existing connection.
Share Firewall Analytics filters
When you add a filter and specify a report duration (time window) in Firewall Analytics, the Cloudflare dashboard URL changes to reflect the parameters you configured. You can share that URL with other users so that they can analyze the same information that you see.
For example, after adding a filter for
Action equals Challenge and setting the report duration to 72 hours, the URL should look like the following: