NAv1 to NAv2 schema map

The following table lists direct mappings between NAv1 and NAv2 fields, when available, and provides related fields when there is no direct mapping available.

ipFlows1mGroups	magicTransitNetworkAnalytics-AdaptiveGroups / spectrumNetworkAnalytics-AdaptiveGroups	dosdNetworkAnalytics-AdaptiveGroups	dosdAttackAnalytics-Groups	flowtrackdNetworkAnalytics-AdaptiveGroups	magicFirewallNetworkAnalytics-AdaptiveGroups
`date`	Related fields: `datetime` `datetimeTenSeconds`	Related fields: `datetime` `datetimeTenSeconds`		Related fields: `datetime` `datetimeTenSeconds`	Related fields: `datetime` `datetimeTenSeconds`
`datetimeMinute`	`datetimeMinute`	`datetimeMinute`		`datetimeMinute`	`datetimeMinute`
`datetimeFiveMinutes`	`datetimeFiveMinutes`	`datetimeFiveMinutes`		`datetimeFiveMinutes`	`datetimeFiveMinutes`
`datetimeFifteenMinutes`	`datetimeFifteenMinutes`	`datetimeFifteenMinutes`		`datetimeFifteenMinutes`	`datetimeFifteenMinutes`
`datetimeHour`	`datetimeHour`	`datetimeHour`		`datetimeHour`	`datetimeHour`
`attackId`*		`attackId`*	`attackId`*
`attackType`			`attackType`
`attackMitigationType`			`mitigationType`
`sourceIPCountry`	`sourceCountry`	`sourceCountry`		`sourceCountry`	`sourceCountry`
`sourceIPAsn`	`sourceAsn`	`sourceAsn`		`sourceAsn`	`sourceAsn`
`sourceIPASNDescription`	Related field: `sourceGeohash`	Related field: `sourceGeohash`		Related field: `sourceGeohash`	Related field: `sourceGeohash`
`coloCode`	`coloCode`	`coloCode`		`coloCode`	`coloCode`
`coloCity`	`coloCity`	`coloCity`		`coloCity`	`coloCity`
`coloCountry`	`coloCountry`	`coloCountry`		`coloCountry`	`coloCountry`
`coloRegion`	Related field: `coloGeohash`	Related field: `coloGeohash`		Related field: `coloGeohash`	Related field: `coloGeohash`
ipFlows1mGroups	magicTransitNetworkAnalytics-AdaptiveGroups / spectrumNetworkAnalytics-AdaptiveGroups	dosdNetworkAnalytics-AdaptiveGroups	dosdAttackAnalytics-Groups	flowtrackdNetworkAnalytics-AdaptiveGroups	magicFirewallNetworkAnalytics-AdaptiveGroups
`ipVersion`	`ethertype`	`ethertype`		`ethertype`	`ethertype`
`bits`	`ipTotalLength` (`bits` divided by 8)	`ipTotalLength` (`bits` divided by 8)	`bits`	`ipTotalLength` (`bits` divided by 8)	`ipTotalLength` (`bits` divided by 8)
`packets`	n/a	n/a	`packets`	n/a	n/a
`ipProtocol`	`ipProtocol`	`ipProtocol`	`ipProtocol`	`ipProtocol`	`ipProtocol`
`sourceIP`	`ipSourceAddress`	`ipSourceAddress`	`sourceIp`	`ipSourceAddress`	`ipSourceAddress`
`destinationIP`	`ipDestinationAddress`	`ipDestinationAddress`	`destinationIp`	`ipDestinationAddress`	`ipDestinationAddress`
`destinationIPv4Range24`	`ipDestinationSubnet`	`ipDestinationSubnet`		`ipDestinationSubnet`	`ipDestinationSubnet`
`destinationIPv4Range23`	n/a	n/a		n/a	n/a
`sourcePort`	`sourcePort`	`sourcePort`	`sourcePort`	`sourcePort`	`sourcePort`
`destinationPort`	`destinationPort`	`destinationPort`	`destinationPort`	`destinationPort`	`destinationPort`
`tcpFlags`	`tcpFlags`	`tcpFlags`	`tcpFlags`	`tcpFlags`	`tcpFlags`

* The attackId field value may be different between NAv1 and NAv2 for the same attack.

Was this helpful?

Cloudflare Dashboard Discord Community Learning Center Support Portal

Cookie Settings

NAv1 to NAv2 schema map

Was this helpful?

What did you like?

What went wrong?

Thank you for helping improve Cloudflare's documentation!