Skip to content
WAF
Visit WAF on GitHub
Set theme to dark (⇧+D)

Firewall Analytics — Paid plans

Adjusting displayed data

You can apply multiple filters and exclusions to narrow the scope of Firewall Analytics, as well as adjust the report duration. Modifying the duration, filters, or exclusions affects the analytics data displayed on the entire page including the Activity Log and all graphs, except for the Denial-of-service attacks mitigated graph.

Add a new filter in Firewall Analytics

Add filters

You can adjust the scope of analytics by manually entering filter conditions. Alternatively, click the Filter or Exclude buttons that appear when hovering over analytics data legend to filter by that field value.

To manually add a filter:

  1. Click Add filter under Firewall Events.
  2. Select a field, an operator, and a value. For example, to filter events by IP address, select IP for Action, select equals for the operator, and enter the IP address.
  3. Click Apply.

Take the following into account when entering filter values:

  • Do not add quotes around values.
  • Do not enter the AS prefix when entering ASN numbers. For example, enter 1423 instead of AS1423.
  • Wildcards are not supported.

Adjust report duration

To adjust report duration, select the desired duration from the dropdown in Firewall Events.

The available report duration values depend on your Cloudflare plan. Refer to Availability for details.

Create Firewall Rule from current filters

To create a Firewall Rule based on the filters and exclusions you selected, click Create firewall rule in Firewall Events.

Events summary

The Events summary section provides the number of Firewall events on traffic during the selected time period, grouped according to the selected dimension (for example, Action, Host, Country, or ASN).

Filter Firewall Analytics by action

You can adjust the displayed data according to one of the values by clicking Filter or Exclude when hovering the legend.

Events by service

The Events by service section lists the Firewall activity per Cloudflare security feature (for example, WAF, Firewall Rules, API Shield).

You can adjust the scope of Firewall Analytics to one of the displayed services by clicking Filter or Exclude when hovering the legend or by clicking the corresponding graph bar.

Top events by source

In Top events by source you can find details of the traffic flagged or actioned by a Cloudflare security feature — for example, IP Addresses, User Agents, Paths, Countries, and Firewall Rules.

You can adjust the scope of Firewall Analytics to one of the listed source values by clicking Filter or Exclude when hovering the value.

Activity log

The Activity log summarizes Firewall events by date to show the action taken and the applied Cloudflare security feature.

Example of Activity log events

Firewall Events are shown by individual event rather than by request. For example, if a single request triggers three different Firewall features, the Firewall Events will show three individual events in the Activity log.

Expand each event to see its details, and define filters and exclusions based on the event's field values. Click the Filter or Exclude button when hovering a field to add the field value to the filters or exclusions list of the displayed analytics. To download the event data in JSON format, click Export event JSON.

Displayed columns

To configure the columns displayed in the Activity log, click Edit columns. This gives you flexibility depending on the type of analysis that you need to perform.

For example, if you are diagnosing a bot-related issue, you may want to see the User agent and the Country columns. On the other hand, if you are trying to identify a DDoS attack, you may want to see IP address, ASN, and Path columns.

Event actions

For a description of the actions that may appear in the Activity Log, refer to Actions.

When the Connection Close action appears in the Activity Log, it means the existing request is unaffected, but the client is instructed to establish a new connection instead of reusing the existing connection.

If you see a Managed Challenge action, it is either related to Cloudflare's bot products or a Firewall rule set on a free account.

Export activity log data

You can export a set of up to 500 raw events from the Activity log in JSON format. Export event data to combine and analyze Cloudflare data with your own stored in a separate system or database, such as a security information and event management system (SIEM). The data you export will reflect any filters you have applied.

To export the displayed events (up to 500), click Export in the Activity log.

Share Firewall Analytics filters

When you add a filter and specify a report duration (time window) in Firewall Analytics, the Cloudflare dashboard URL changes to reflect the parameters you configured. You can share that URL with other users so that they can analyze the same information that you see.

For example, after adding a filter for Action equals Challenge and setting the report duration to 72 hours, the URL should look like the following:

https://dash.cloudflare.com/<account-id>/example.net/firewall?action=challenge&time-window=4320

To print or download a snapshot report from your Firewall Events analytics dashboard, click Print report in Firewall Events. Your web browser's printing interface will present you with options for printing or downloading the PDF report.

The generated report will reflect all applied filters.

Layer 4 denial-of-service attack mitigation

In Denial-of-service attacks mitigated you have visibility over mitigated Layer 4 denial-of-service SYN attacks towards your zones in the past seven days.

Denial-of-service attacks mitigated

You can also use the synAvgPps1mGroups node in GraphQL to get the total attack volume for a zone over a period of time.