GraphQL
This lists all of the available datasets and fields in Cloudflare's GraphQL API.
AccountAccessLoginRequestsAdaptiveGroups
Access login requests
Field | Description |
---|---|
avg | |
count | Number of access login API events processed |
dimensions | List of dimensions to group by |
AccountAccessLoginRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountAccessLoginRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
appId | Access application ID |
approvingPolicyId | Policy ID that approved the user |
cfRayId | CF ray id |
country | Country tag |
date | The date the access login event was emitted |
datetime | The date and time the access login event was emitted |
datetimeMinute | The date and time the access login event was emitted truncated to the minute |
deviceId | Device ID |
hasExistingJWT | Has existing JWT (0 = false, 1 = true) |
hasGatewayEnabled | Has Gateway enabled (0 = false, 1 = true) |
hasWarpEnabled | Has WARP enabled (0 = false, 1 = true) |
identityProvider | Identity provider |
ipAddress | User IP address |
isSuccessfulLogin | If the login was successful (0 = false, 1 = true) |
mtlsCertSerialId | MTLS certificate serial ID |
mtlsCommonName | MTLS common name |
mtlsStatus | MTLS status (may show error message if status is not successful) |
serviceTokenId | Service token ID |
userUuid | User UUID |
AccountAccessLoginRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAccessLoginRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroups
Network analytics data for Advanced DNS Protection
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
dnsQueryName | The requested domain name in the DNS query |
dnsQueryType | The query type in the DNS query |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationReason | Reason for applying a mitigation to the packet, if any |
mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroups
Network analytics data for Advanced TCP Protection
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationReason | Reason for applying a mitigation to the packet, if any |
mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
protocolState | State of the packet in the context of the protocol, if available |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountAiGatewayCacheAdaptiveGroups
AI Gateway Cache
Field | Description |
---|---|
count | Total number of requests for an account with caching enabled: including hits and misses |
dimensions | List of dimensions to group by |
AccountAiGatewayCacheAdaptiveGroupsDimensions
Field | Description |
---|---|
cacheOp | Cache Hit or Miss: 1 = cache hit, 0 = cache miss |
date | The date when trigger was triggerd |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
gateway | Gateway name |
model | Which model was the request sent to |
provider | Which provider was the request sent to |
tokensIn | Number of tokens in the request |
tokensOut | Number of tokens in the response |
AccountAiGatewayCacheAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAiGatewayCacheAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAiGatewayErrorsAdaptiveGroups
AI Gateway Errors
Field | Description |
---|---|
count | Number of errors |
dimensions | List of dimensions to group by |
AccountAiGatewayErrorsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date when trigger was triggerd |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
gateway | Gateway name |
model | Which models was the request sent to |
provider | Which provider was the request sent to |
AccountAiGatewayErrorsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAiGatewayErrorsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAiGatewayRequestsAdaptiveGroups
AI Gateway Requests
Field | Description |
---|---|
count | Number of processed requests |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountAiGatewayRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
cached | Was the response served from cache?: 1 = cache hit, 0 = cache misss |
date | The date when trigger was triggered |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
error | Was the response an error: 1 , 0 for no error |
gateway | Gateway name |
model | Which models was the request sent to |
provider | Which provider was the request sent to |
rateLimited | Was the request rate limited?: 1 = rate limit applied, 0 = rate limit not applied |
tokensIn | Number of tokens in the request |
tokensOut | Number of tokens in the response |
AccountAiGatewayRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAiGatewayRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAiGatewayRequestsAdaptiveGroupsSum
Field | Description |
---|---|
cachedTokensIn | Sum of cached tokens in |
cachedTokensOut | Sum of cached tokens out |
uncachedTokensIn | Sum of uncached tokens in |
uncachedTokensOut | Sum of uncached tokens out |
AccountAiInferenceAdaptive
AI Inference logs with adaptive sampling
Field | Description |
---|---|
costMetricName1 | Name for cost metric 1 |
costMetricName2 | Name for cost metric 2 |
costMetricValue1 | Value for cost metric 1 |
costMetricValue2 | Value for cost metric 2 |
datetime | The date when inferance was triggered |
errorCode | Error code |
inferenceTimeMs | Inference time ms |
modelId | ModelId that was trigger to inference |
modelIsBeta | Model that was trigger to inference is Beta |
neurons | Monetization unit |
requestBytesIn | Request size in bytes |
requestBytesOut | Request size out bytes |
requestSource | Source who triggered (worker binding, pages binding, rest api) |
sampleInterval | ABR sample interval |
AccountAiInferenceAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountAiInferenceAdaptiveGroups
Aggregated AI Inference logs with adaptive sampling
Field | Description |
---|---|
count | Total number of inferences for an account |
dimensions | List of dimensions to group by |
sum |
AccountAiInferenceAdaptiveGroupsDimensions
Field | Description |
---|---|
costMetricName1 | Name for cost metric 1 |
costMetricName2 | Name for cost metric 2 |
costMetricValue1 | Value for cost metric 1 |
costMetricValue2 | Value for cost metric 2 |
date | The date when starts the inference |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
errorCode | Error code |
inferenceTimeMs | Inference time ms |
modelId | ModelId that was trigger to inference |
modelIsBeta | Model that was trigger to inference is Beta |
neurons | Monetization unit |
requestBytesIn | Request size in bytes |
requestBytesOut | Request size out bytes |
requestSource | Source who triggered (worker binding, pages binding, rest api) |
AccountAiInferenceAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAiInferenceAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAiInferenceAdaptiveGroupsSum
Field | Description |
---|---|
totalCostMetricValue1 | Total value for cost metric 1 |
totalCostMetricValue2 | Total value for cost metric 2 |
totalInferenceTimeMs | Total inference time ms |
totalNeurons | Total neurons |
totalRequestBytesIn | Total bytes in per request |
totalRequestBytesOut | Total bytes out per request |
AccountAiInferenceAdaptiveOrderBy
Field | Description |
---|---|
AccountBrowserRenderingEventsAdaptive
Browser Rendering events with adaptive sampling
Field | Description |
---|---|
browserCloseReason | Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted) |
browserEndTime | Browser session end time |
browserStartTime | Browser session start time |
connectionEndTime | When worker ended devtools connection to browser session |
connectionId | Worker connection ID, when available |
connectionStartTime | When worker started devtools connection to browser session |
datetime | The time of the event |
sampleInterval | ABR sample interval |
scriptName | Name of worker who initiated the request |
sessionId | Browser session ID |
AccountBrowserRenderingEventsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountBrowserRenderingEventsAdaptiveGroups
Aggregated Browser Rendering events with adaptive sampling
Field | Description |
---|---|
count | Total number of events for an account |
dimensions | List of dimensions to group by |
max | The maximum value for a metric per dimension |
min | The minimum value for a metric per dimension |
uniq |
AccountBrowserRenderingEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
browserCloseReason | Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted) |
connectionId | Worker connection ID, when available |
date | The date of the event |
datetimeFifteenMinutes | The date and time of the event truncated to fifteen minutes |
datetimeFiveMinutes | The date and time of the event truncated to five minutes |
datetimeHour | The date and time of the event truncated to the hour |
datetimeMinute | The date and time of the event truncated to the minute |
scriptName | Name of worker who initiated the request |
sessionId | Browser session ID |
AccountBrowserRenderingEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountBrowserRenderingEventsAdaptiveGroupsMax
Field | Description |
---|---|
finalBrowserCloseReason | Browser close reason |
latestBrowserEndTime | Browser end time |
AccountBrowserRenderingEventsAdaptiveGroupsMin
Field | Description |
---|---|
earliestBrowserStartTime | Browser start time |
AccountBrowserRenderingEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountBrowserRenderingEventsAdaptiveGroupsUniq
Field | Description |
---|---|
connectionIdCount | Unique worker connections |
sessionIdCount | Unique browser sessions |
AccountBrowserRenderingEventsAdaptiveOrderBy
Field | Description |
---|---|
AccountCallsStatusAdaptive
(TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling
Field | Description |
---|---|
appId | The appId that generated traffic |
datetime | The date and time the event was recorded |
event | The description of the event related to a session or a track |
sessionId | The generated string that identifies a PeerConnection |
trackId | The track identifier provided to us within a PeerConnection |
AccountCallsStatusAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountCallsStatusAdaptiveOrderBy
Field | Description |
---|---|
AccountCallsTurnUsageAdaptiveGroups
Aggregated Calls TURN bandwidth usage with adaptive sampling"
Field | Description |
---|---|
avg | |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountCallsTurnUsageAdaptiveGroupsAvg
Field | Description |
---|---|
concurrentConnectionsFifteenMinutes | Average concurrent connections when grouped by datetimeFifteenMinutes |
concurrentConnectionsFiveMinutes | Average concurrent connections when grouped by datetimeFiveMinutes |
concurrentConnectionsHour | Average concurrent connections when grouped by datetimeHour |
concurrentConnectionsMinute | Average concurrent connections when grouped by datetimeMinute |
AccountCallsTurnUsageAdaptiveGroupsDimensions
Field | Description |
---|---|
customIdentifier | The customIdentifier (provided when credential was generated) that generated traffic |
date | Calls TURN bandwidth metrics date |
datetimeFifteenMinutes | Calls TURN bandwidth metrics timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | Calls TURN bandwidth metrics timestamp, truncated to five minutes |
datetimeHour | Calls TURN bandwidth metrics timestamp, truncated to the hour |
datetimeMinute | Calls TURN bandwidth metrics timestamp, truncated to the minute |
keyId | The credentials created by this keyId that generated traffic |
username | The username from credential that generated traffic |
AccountCallsTurnUsageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountCallsTurnUsageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountCallsTurnUsageAdaptiveGroupsSum
Field | Description |
---|---|
egressBytes | The total bytes sent by Calls TURN, observed over the queried time period |
ingressBytes | The total bytes received by Calls TURN, observed over the queried time period |
AccountCallsUsageAdaptiveGroups
Beta. Aggregated Calls SFU bandwidth usage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountCallsUsageAdaptiveGroupsDimensions
Field | Description |
---|---|
appId | The appId that generated traffic |
date | Calls bandwidth metrics date |
datetimeFifteenMinutes | Calls bandwidth metrics timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | Calls bandwidth metrics timestamp, truncated to five minutes |
datetimeHour | Calls bandwidth metrics timestamp, truncated to the hour |
datetimeMinute | Calls bandwidth metrics timestamp, truncated to the minute |
sessionId | The generated string that identifies a PeerConnection |
trackId | The track identifier provided to us within a PeerConnection |
trackType | Describes if the track contains video, audio, or data |
AccountCallsUsageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountCallsUsageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountCallsUsageAdaptiveGroupsSum
Field | Description |
---|---|
egressBytes | The total bytes sent by Calls, observed over the queried time period |
ingressBytes | The total bytes received by Calls, observed over the queried time period |
AccountCdnNetworkAnalyticsAdaptiveGroups
Network analytics data for Cloudflare CDN traffic
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountCdnNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountCdnNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationDeviceTag | Device tag associated with the destination IP of the packet |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationSystem | Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
popName | Cloudflare PoP that received the packet (unique site identifier) |
prefixTag | IP prefix tag associated with the packet |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceDeviceTag | Device tag associated with the source IP of the packet |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
AccountCdnNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountCdnNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountCdnNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountD1AnalyticsAdaptiveGroups
Beta. Aggregated D1 analytics with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Number of requests to D1 processed |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountD1AnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
queryBatchResponseBytes | The total number of bytes in the response, including all returned rows and metadata (average/mean). |
queryBatchTimeMs | Query batch response time in milliseconds (average/mean). |
sampleInterval | The average value used for sample interval |
AccountD1AnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
databaseId | The UUID of a D1 database |
date | The date the D1 request was received |
datetimeFifteenMinutes | The date and time the D1 request was received truncated to fifteen minutes |
datetimeFiveMinutes | The date and time the D1 request was received truncated to five minutes |
datetimeHour | The date and time the D1 request was received truncated to the hour |
datetimeMinute | The date and time the D1 request was received truncated to the minute |
AccountD1AnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountD1AnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountD1AnalyticsAdaptiveGroupsQuantiles
Field | Description |
---|---|
queryBatchResponseBytesP50 | The total number of bytes in the response, including all returned rows and metadata (50th percentile). |
queryBatchResponseBytesP90 | The total number of bytes in the response, including all returned rows and metadata (90th percentile). |
queryBatchTimeMsP50 | Query batch response time in milliseconds (50th percentile). |
queryBatchTimeMsP90 | Query batch response time in milliseconds (90th percentile). |
AccountD1AnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
queryBatchResponseBytes | The total number of bytes in the response, including all returned rows and metadata. |
readQueries | The number of read queries. |
rowsRead | The number of rows your queries read. |
rowsWritten | The number of rows your queries wrote. |
writeQueries | The number of write queries. |
AccountD1QueriesAdaptiveGroups
Beta. D1 query metrics with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Number of D1 queries processed |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountD1QueriesAdaptiveGroupsAvg
Field | Description |
---|---|
queryDurationMs | The average duration queries in D1 took, observed over the queried time period. |
rowsRead | The average number of rows scanned, observed over the queried time period. |
rowsReturned | The average number of rows returned, observed over the queried time period. |
rowsWritten | The average number of rows written, observed over the queried time period. |
sampleInterval | The average value used for sample interval |
AccountD1QueriesAdaptiveGroupsDimensions
Field | Description |
---|---|
databaseId | The UUID of a D1 database |
date | D1 query sample timestamp |
datetimeFifteenMinutes | D1 query sample timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | D1 query sample timestamp, truncated to five minutes |
datetimeHour | D1 query sample timestamp, truncated to the hour |
datetimeMinute | D1 query sample timestamp, truncated to the minute |
query | The SQL query that ran on a D1 database, with parameterized values replaced with placeholders. |
AccountD1QueriesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountD1QueriesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountD1QueriesAdaptiveGroupsQuantiles
Field | Description |
---|---|
queryDurationMsP50 | 50th percentile Query Duration (milliseconds) |
queryDurationMsP95 | 95th percentile Query Duration (milliseconds) |
queryDurationMsP99 | 99th percentile Query Duration (milliseconds) |
AccountD1QueriesAdaptiveGroupsSum
Field | Description |
---|---|
queryDurationMs | The total duration queries in D1 took, observed over the queried time period. |
rowsRead | The total number of rows scanned, observed over the queried time period. |
rowsReturned | The total number of rows returned, observed over the queried time period. |
rowsWritten | The total number of rows written, observed over the queried time period. |
AccountD1StorageAdaptiveGroups
Beta. D1 storage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
AccountD1StorageAdaptiveGroupsDimensions
Field | Description |
---|---|
databaseId | The UUID of a D1 database |
date | D1 storage sample timestamp |
datetimeFifteenMinutes | D1 storage sample timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | D1 storage sample timestamp, truncated to five minutes |
datetimeHour | D1 storage sample timestamp, truncated to the hour |
datetimeMinute | D1 storage sample timestamp, truncated to the minute |
AccountD1StorageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountD1StorageAdaptiveGroupsMax
Field | Description |
---|---|
databaseSizeBytes | The maximum size of the database (measured in bytes) observed over the queried time period. |
AccountD1StorageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountDosdAttackAnalyticsGroups
Attack analytics metadata for attacks detected by dosd
Field | Description |
---|---|
attackId | Unique identifier of the mitigation that matched the packet, if any |
attackType | DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic |
attackVector | Description of attack vector |
bits | Sum of bits received during the attack |
commonTcpFlags | Common TCP flags used by attack traffic, if any |
commonTcpFlagsNames | Names of common TCP flags used by attack traffic, if any |
destinationIp | Fixed destination IP used by attack traffic, if any |
destinationPort | Fixed destination port used by attack traffic, if any |
droppedBits | Sum of bits dropped during the attack |
droppedPackets | Sum of packets dropped during the attack |
endDatetime | Date and time that the attack ended; not available for ongoing attacks |
ipProtocol | Fixed protocol used by attack traffic, if any |
ipProtocolName | Fixed protocol used by attack traffic, if any |
mitigationReason | Type of mitigation applied to attack traffic |
mitigationScope | Whether mitigation was applied in only some locations or globally |
mitigationType | Type of mitigation applied to attack traffic |
packets | Sum of packets received during the attack |
ruleId | Unique identifier of the rule that matched the packet, if any |
ruleName | Human-readable name of the rule that matched the packet, if any |
rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
sourceIp | Fixed source IP used by attack traffic, if any |
sourcePort | Fixed source port used by attack traffic, if any |
startDatetime | Date and time that the attack started |
tcpFlags | Fixed TCP flags used by attack traffic, if any |
tcpFlagsNames | Names of fixed TCP flags used by attack traffic, if any |
AccountDosdAttackAnalyticsGroupsFilter_InputObject
Field | Description |
---|---|
AccountDosdAttackAnalyticsGroupsOrderBy
Field | Description |
---|---|
AccountDosdNetworkAnalyticsAdaptiveGroups
Network analytics data for dosd
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountDosdNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountDosdNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
attackId | Unique identifier of the mitigation that matched the packet, if any |
attackVector | Attack vector of the rule that matched the packet, if any |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationReason | Reason for applying a mitigation to the packet, if any |
mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
protocolState | State of the packet in the context of the protocol, if available |
ruleId | Unique identifier of the rule that matched the packet, if any |
ruleName | Human-readable name of the rule that matched the packet, if any |
rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountDosdNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountDosdNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountDosdNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountDurableObjectsInvocationsAdaptiveGroups
Durable Objects invocations with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
dimensions | List of dimensions to group by |
max | The max value for a metric |
min | The min value for a metric |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountDurableObjectsInvocationsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
AccountDurableObjectsInvocationsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of a minute |
environmentName | The name of the script environment |
namespaceId | Durable Object namespace ID |
objectId | Durable Object ID as a hex string |
scriptName | The name of the script |
status | Status of the worker invocation |
AccountDurableObjectsInvocationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountDurableObjectsInvocationsAdaptiveGroupsMax
Field | Description |
---|---|
responseBodySize | Maximum response body size for one request - bytes |
wallTime | Maximum wall time for one request - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsMin
Field | Description |
---|---|
responseBodySize | Minimum response body size for one request - bytes |
wallTime | Minimum wall time for one request - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountDurableObjectsInvocationsAdaptiveGroupsQuantiles
Field | Description |
---|---|
responseBodySizeP25 | Response body size 25th percentile - bytes |
responseBodySizeP50 | Response body size 50th percentile - bytes |
responseBodySizeP75 | Response body size 75th percentile - bytes |
responseBodySizeP90 | Response body size 90th percentile - bytes |
responseBodySizeP99 | Response body size 99th percentile - bytes |
responseBodySizeP999 | Response body size 99.9th percentile - bytes |
wallTimeP25 | Wall time 25th percentile - microseconds |
wallTimeP50 | Wall time 50th percentile - microseconds |
wallTimeP75 | Wall time 75th percentile - microseconds |
wallTimeP90 | Wall time 90th percentile - microseconds |
wallTimeP99 | Wall time 99th percentile - microseconds |
wallTimeP999 | Wall time 99.9th percentile - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsSum
Field | Description |
---|---|
errors | Sum of errors |
requests | Sum of requests |
responseBodySize | Sum of response body sizes |
wallTime | Sum of wall time |
AccountDurableObjectsPeriodicGroups
Durable Objects periodic metrics
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The max value for a metric |
sum | The sum of values for a metric per dimension |
AccountDurableObjectsPeriodicGroupsDimensions
Field | Description |
---|---|
date | Datetime the metrics period started, truncated to start of a day |
datetimeHour | Datetime the metrics period started, truncated to start of an hour |
datetimeMinute | Datetime the metrics period started, truncated to start of a minute |
namespaceId | Durable Object namespace ID |
objectId | Durable Object ID as a hex string |
AccountDurableObjectsPeriodicGroupsFilter_InputObject
Field | Description |
---|---|
AccountDurableObjectsPeriodicGroupsMax
Field | Description |
---|---|
activeWebsocketConnections | Maximum active websocket connections in the time window |
AccountDurableObjectsPeriodicGroupsOrderBy
Field | Description |
---|---|
AccountDurableObjectsPeriodicGroupsSum
Field | Description |
---|---|
activeTime | Sum of active time - microseconds |
cpuTime | Sum of CPU time - microseconds |
duration | Sum of Duration - GB*s |
exceededCpuErrors | Sum of CPU exceeded errors |
exceededMemoryErrors | Sum of memory exceeded errors |
fatalInternalErrors | Sum of fatal internal server errors |
inboundWebsocketMsgCount | Sum of incoming websocket messages |
outboundWebsocketMsgCount | Sum of outbound websocket messages |
rowsRead | Sum of rows read (by sqlite backed DOs) |
rowsWritten | Sum of rows written (by sqlite backed DOs) |
storageDeletes | Sum of storage deletes (by non-sqlite backed DOs) |
storageReadUnits | Sum of storage reads - in 4KB units (by non-sqlite backed DOs) |
storageWriteUnits | Sum of storage writes - in 4KB units (by non-sqlite backed DOs) |
subrequests | Sum of subrequests |
AccountDurableObjectsStorageGroups
Durable Objects storage metrics
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The sum of values for a metric per dimension |
AccountDurableObjectsStorageGroupsDimensions
Field | Description |
---|---|
date | Datetime that the storage usage was recorded, truncated to start of a day |
datetimeHour | Datetime that the storage usage was recorded, truncated to start of an hour |
AccountDurableObjectsStorageGroupsFilter_InputObject
Field | Description |
---|---|
AccountDurableObjectsStorageGroupsMax
Field | Description |
---|---|
storedBytes | Max of stored bytes |
AccountDurableObjectsStorageGroupsOrderBy
Field | Description |
---|---|
AccountDurableObjectsSubrequestsAdaptiveGroups
Durable Objects subrequests with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountDurableObjectsSubrequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of a minute |
environmentName | The name of the script environment |
namespaceId | Durable Object namespace ID |
objectId | Durable Object ID as a hex string |
scriptName | The name of the script |
AccountDurableObjectsSubrequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountDurableObjectsSubrequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountDurableObjectsSubrequestsAdaptiveGroupsSum
Field | Description |
---|---|
requestBodySizeUncached | Outgoing Durable Objects fetch request body size in bytes where the request was not cached |
AccountFbmAttackAnalyticsGroups
FBM analytics metadata for attacks detected by dosd
Field | Description |
---|---|
attackId | Unique identifier of the mitigation that matched the packet, if any |
attackType | DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic |
attackVector | Description of attack vector |
bits | Sum of bits received during the attack |
commonTcpFlags | Common TCP flags used by attack traffic, if any |
commonTcpFlagsNames | Names of common TCP flags used by attack traffic, if any |
destinationIp | Fixed destination IP used by attack traffic, if any |
destinationPort | Fixed destination port used by attack traffic, if any |
droppedBits | Sum of bits dropped during the attack |
droppedPackets | Sum of packets dropped during the attack |
endDatetime | Date and time that the attack ended; not available for ongoing attacks |
ipProtocol | Fixed protocol used by attack traffic, if any |
ipProtocolName | Fixed protocol used by attack traffic, if any |
mitigationReason | Type of mitigation applied to attack traffic |
mitigationScope | Whether mitigation was applied in only some locations or globally |
mitigationType | Type of mitigation applied to attack traffic |
packets | Sum of packets received during the attack |
ruleId | Unique identifier of the rule that matched the packet, if any |
ruleName | Human-readable name of the rule that matched the packet, if any |
rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
sourceIp | Fixed source IP used by attack traffic, if any |
sourcePort | Fixed source port used by attack traffic, if any |
startDatetime | Date and time that the attack started |
tcpFlags | Fixed TCP flags used by attack traffic, if any |
tcpFlagsNames | Names of fixed TCP flags used by attack traffic, if any |
AccountFbmAttackAnalyticsGroupsFilter_InputObject
Field | Description |
---|---|
AccountFbmAttackAnalyticsGroupsOrderBy
Field | Description |
---|---|
AccountFilter_InputObject
Field | Description |
---|---|
AccountFirewallEventsAdaptive
Raw Firewall events with adaptive sampling
Field | Description |
---|---|
action | The code of the first-class action the Cloudflare Firewall took on this request |
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botScore | The final score originated from bot management detections. |
botScoreSrcName | Name of the source detection which generated the bot management score. |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
clientRefererHost | The referer host |
clientRefererPath | The referer path requested by visitor |
clientRefererQuery | The referer query-string was requested by the visitor |
clientRefererScheme | The referer url scheme requested by the visitor |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | The HTTP method used by the visitor |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | The query-string was requested by the visitor |
clientRequestScheme | The url scheme requested by the visitor |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
description | The description of the rule triggered by this request |
edgeColoName | The airport code of the Cloudflare datacenter that served this request |
edgeResponseStatus | HTTP response status code returned to browser |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
kind | The kind of event, currently only possible values are: firewall |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
matchIndex | Rules match index in the chain |
metadata | Additional product-specific information. Metadata is organized in key:value pairs |
originResponseStatus | HTTP origin response status code returned to browser |
originatorRayName | The RayId of the request that issued the challenge/jschallenge |
rayName | The RayId of the request |
ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
ruleId | The Cloudflare security product-specific RuleId triggered by this request |
rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
sampleInterval | ABR sample interval |
source | The Cloudflare security product triggered by this request |
userAgent | visitor's user-agent string |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore ): Beta. Overall request score generated by the WAF detection module |
wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore ): Beta. WAF ML score for an SQLi attack |
wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore ): Beta. WAF ML score for an XSS attack |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
AccountFirewallEventsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountFirewallEventsAdaptiveGroups
Aggregated Firewall events with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
count | The sum of sample interval values |
dimensions | List of dimensions to group by |
sum |
AccountFirewallEventsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
AccountFirewallEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | The code of the first-class action the Cloudflare Firewall took on this request |
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botScore | The final score originated from bot management detections. |
botScoreSrcName | Name of the source detection which generated the bot management score. |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
clientRefererHost | The referer host |
clientRefererPath | The referer path requested by visitor |
clientRefererQuery | The referer query-string was requested by the visitor |
clientRefererScheme | The referer url scheme requested by the visitor |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | The HTTP method used by the visitor |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | The query-string was requested by the visitor |
clientRequestScheme | The url scheme requested by the visitor |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
description | The description of the rule triggered by this request |
edgeColoName | The airport code of the Cloudflare datacenter that served this request |
edgeResponseStatus | HTTP response status code returned to browser |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
kind | The kind of event, currently only possible values are: firewall |
matchIndex | Rules match index in the chain |
originResponseStatus | HTTP origin response status code returned to browser |
originatorRayName | The RayId of the request that issued the challenge/jschallenge |
rayName | The RayId of the request |
ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
ruleId | The Cloudflare security product-specific RuleId triggered by this request |
rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
sampleInterval | ABR sample interval |
source | The Cloudflare security product triggered by this request |
userAgent | visitor's user-agent string |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore ): Beta. Overall request score generated by the WAF ML detection module |
wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore ): Beta. WAF ML score for an SQLi attack |
wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore ): Beta. WAF ML score for an XSS attack |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
AccountFirewallEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountFirewallEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountFirewallEventsAdaptiveGroupsSum
Field | Description |
---|---|
botDetectionIdArray | Array of bot management detection ids |
botDetectionIdCountArray | Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index. |
botDetectionTagArray | Array of bot management detection tags |
botDetectionTagCountArray | Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index. |
AccountFirewallEventsAdaptiveJa4SignalsElem
Field | Description |
---|---|
signalName | Signal name |
signalValue | Signal value |
AccountFirewallEventsAdaptiveMetadataElem
Field | Description |
---|---|
key | The key of the metadata. Key format can vary by Cloudflare security product and can change over time. |
value | The value of the metadata. Value format can vary by Cloudflare security product and can change over time. |
AccountFirewallEventsAdaptiveOrderBy
Field | Description |
---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroups
Network analytics data for flowtrackd
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationReason | Reason for applying a mitigation to the packet, if any |
mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
protocolState | State of the packet in the context of the protocol, if available |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountGatewayL4DownstreamSessionsAdaptiveGroups
Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close
Field | Description |
---|---|
count | The number of downstream sessions |
dimensions | List of dimensions to group by |
quantiles | |
sum |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsDimensions
Field | Description |
---|---|
coloCode | IATA Airport code that represents the city in which a Cloudflare data center (colo) is located |
coloCountry | ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located |
date | Start timestamp of this session, truncated to date |
datetimeFifteenMinutes | Start timestamp of this session, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Start timestamp of this session, truncated to multiple of 5 minutes |
datetimeHour | Start timestamp of this session, truncated to the hour |
datetimeMinute | Start timestamp of this session, truncated to the minute |
quicErrorCode | QUIC specific error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes |
rttUs | Last Round Trip Time estimation for this session in microseconds |
sessionId | Identifier for this session |
sourceIP | IP address of the client making this session |
tokenAuthStatus | Client token authentication status. Possible values are success | failed with invalid token and upto date token key ID | failed with invalid token due to outdated/missing token key ID | failed due to reused token |
tokenSigningRegion | Broad location assigned to client in this session |
transport | Transport protocol used for this session. Possible values are tcp | quic | udp |
transportHandshakeDurationUs | Time taken for TCP/TLS or QUIC handshake in microsecond |
transportStatus | Transport Status. Possible values are unknown | success | failure |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayL4DownstreamSessionsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayL4DownstreamSessionsAdaptiveGroupsQuantiles
Field | Description |
---|---|
tokenAuthDurationUsP50 | Time taken for Client Token Authentication in microseconds |
transportHandshakeDurationUsP50 | Time taken for TCP/TLS or QUIC handshake in microseconds |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsSum
Field | Description |
---|---|
bytesRecvd | Total bytes received in this session |
bytesSent | Total bytes sent in this session |
clientBytesRetransmitted | Total bytes retransmitted by client in this session |
packetsRecvd | Total number of packets received in this session |
packetsSent | Total number of packets sent in this session |
tokenAuthDurationUs | Time taken for client token authentication in microseconds |
AccountGatewayL4SessionsAdaptiveGroups
BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling
Field | Description |
---|---|
count | The number of Gateway L4 sessions |
dimensions | List of dimensions to group by |
AccountGatewayL4SessionsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | action taken by gateway |
applicationIds | IDs of the applications that matched the session parameters |
applicationNames | Names of the applications that matched the session parameters |
coloCode | Colo Code of edge server |
datetime | Datetime that the session was started |
datetimeHour | Datetime that the session was started truncated to hours |
datetimeMinute | Datetime that the session was started truncated to minutes |
destinationIp | The destination IP address for the session |
destinationPort | The destination port for the session |
detectedProtocol | The detected protocol of network traffic |
deviceId | The device ID of the gateway user who initiated the session |
dstIpContinent | Continent code of the session destination IP address |
dstIpCountry | Country code of the session destination IP address |
The email address of the gateway user who initiated the session | |
proxyEndpoint | The proxy endpoint used on this session |
sessionId | The network session unique identifier |
sni | The SNI pulled from the session tls handshake, if present |
sourceInternalIp | Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp |
sourceIp | The source IP address for the session |
sourcePort | The source port for the session |
srcIpContinent | Continent code of the session source IP address |
srcIpCountry | Country code of the session source IP address |
transport | DEPRECATED (Field is replaced with transportProtocol ): The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp). Deprecated, please use transportProtocol |
transportProtocol | The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp) |
userId | The ID of the gateway user who initiated the session |
virtualNetworkId | The ID of the virtual nework the device was connected to |
virtualNetworkName | The name of the virtual nework the device was connected to |
AccountGatewayL4SessionsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayL4SessionsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroups
Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close
Field | Description |
---|---|
count | The number of upstream sessions |
dimensions | List of dimensions to group by |
quantiles | |
sum |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsDimensions
Field | Description |
---|---|
coloCode | IATA Airport code that represents the city in which a Cloudflare data center (colo) is located |
coloCountry | ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located |
date | Start timestamp of this session, truncated to date |
datetimeFifteenMinutes | Start timestamp of this session, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Start timestamp of this session, truncated to multiple of 5 minutes |
datetimeHour | Start timestamp of this session, truncated to the hour |
datetimeMinute | Start timestamp of this session, truncated to the minute |
destinationIP | IP address of the origin server |
domainName | SNI domain name for this session |
downstreamSessionId | Downstream session identifier of this session |
httpConnectReqStatus | Client HTTP CONNECT request status. Possible values are unknown | success | failure |
quicErrorCode | QUIC error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes |
rttUs | Last Round Trip Time estimation for this session in microseconds |
tokenSigningRegion | Broad location assigned to client in this session |
totalTunnelSetupDurationUs | Total time taken for tunnel setup in microseconds |
transport | Transport protocol used for this session. Possible values are tcp | quic | udp |
transportStatus | Transport status. Possible values are unknown | success | failure |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroupsQuantiles
Field | Description |
---|---|
connectReqHandlingDurationUsP50 | Time taken for CONNECT request handling in microseconds |
totalTunnelSetupDurationUsP50 | Total time taken for tunnel setup in microseconds |
tunnelSetupDurationUsP50 | Time taken to setup the tunnel in microseconds |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsSum
Field | Description |
---|---|
bytesRecvd | Total bytes received in this session |
bytesSent | Total bytes sent in this session |
connectReqHandlingDurationUs | Time taken for CONNECT request handling in microseconds |
originBytesRetransmitted | Total bytes retransmitted by origin in this session |
packetsRecvd | Total number of packets received in this session |
packetsSent | Total number of packets sent in this session |
totalTunnelSetupDurationUs | Total time taken for tunnel setup in microseconds |
tunnelSetupDurationUs | Time taken for tunnel setup in microseconds |
AccountGatewayL7RequestsAdaptiveGroups
BETA - Aggregate counts of Gateway L7 requests with adaptive sampling
Field | Description |
---|---|
count | The number of Gateway L7 requests |
dimensions | List of dimensions to group by |
AccountGatewayL7RequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | action taken by gateway |
applicationIds | IDs of the applications that matched the request parameters |
applicationNames | Names of the applications that matched the request parameters |
categoryIds | IDs of the categories that matched the request parameters |
categoryNames | Names of the categories that matched the request parameters |
coloCode | Colo Code of edge server |
datetime | Datetime that the request happened |
datetimeHour | Datetime that the request happened truncated to hours |
datetimeMinute | Datetime that the request happened truncated to minutes |
deviceId | The device ID of the gateway user who made the request |
dstIpContinent | Continent code of the request destination IP address |
dstIpCountry | Country code of the request destination IP address |
The email address of the gateway user who made the request | |
httpHost | The destination host for the request |
httpStatusCode | HTTP status code gateway returned to the user. 0 if nothing was returned(e.g client disconnected) |
isIsolated | Indicates whether this request was made through an isolated link |
privateAppAUD | Access private app AUD |
proxyEndpoint | The proxy endpoint used on this request |
quarantined | Indicates if the request content was quarantined |
requestId | The request unique identifier |
sourceInternalIp | Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp |
srcIpContinent | Continent code of the request source IP address |
srcIpCountry | Country code of the request source IP address |
untrustedCertificateAction | Action taken when an untrusted origin certificate error occurs |
url | The request URL |
userId | The ID of the gateway user who made the request |
virtualNetworkId | The ID of the virtual nework the device was connected to |
virtualNetworkName | The name of the virtual nework the device was connected to |
AccountGatewayL7RequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayL7RequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayResolverByCategoryAdaptiveGroups
BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling
Field | Description |
---|---|
count | The number of Gateway Resolver queries |
dimensions | List of dimensions to group by |
AccountGatewayResolverByCategoryAdaptiveGroupsDimensions
Field | Description |
---|---|
authoritativeNameserverIps | List of IPs of the authoritative nameservers that provided the answers, if any |
categoryId | ID of the category that was assigned to the domain |
cnames | List of resolved intermediate cname domains |
datetime | The date and time the DNS query was resolved |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to minutes |
dohSubdomain | The destination DoH subdomain the DNS query was made to |
dotSubdomain | The destination DoT subdomain the DNS query was made to |
edeErrors | List of returned Extended DNS Error Codes |
locationId | The uuid identifying the customer Location used when resolving |
matchedApplicationId | ID of the application the domain belongs to |
matchedApplicationName | Name of the application the domain belongs to |
policyId | ID of the policy/rule that was applied, if any |
policyName | Name of the policy that was applied, if any |
resolvedIpContinents | Continent code of each resolved IP, if any |
resolvedIpCountries | Country code of each resolved IP, if any |
resolvedIps | List of resolved IPs in the response, if any |
resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
resourceRecordClasses | Resource records' classes |
resourceRecordNames | Resource records' names |
resourceRecordRDatas | Resource records' rdata values |
resourceRecordTTLs | Resource records' TTL values |
resourceRecordTypes | Resource records' types |
srcIpContinent | Continent code of the source IP address making the DNS query |
srcIpCountry | Country code of the source IP address making the DNS query |
AccountGatewayResolverByCategoryAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayResolverByCategoryAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayResolverByCustomResolverGroups
Stats on dns custom resolvers
Field | Description |
---|---|
avg | The average value for a metric |
count | The number of Gateway Resolver queries |
dimensions | List of dimensions to group by |
max | Maximum response time |
AccountGatewayResolverByCustomResolverGroupsAvg
Field | Description |
---|---|
customResolverTimeInMs | Average latency |
sampleInterval | Average sample interval |
AccountGatewayResolverByCustomResolverGroupsDimensions
Field | Description |
---|---|
cacheStatus | whether the response was cached or not |
customResolverAddress | address at which custom resolver query was resolved at |
customResolverResponseCode | Response code recieved from the custom resolver 0 => unknown 27 => dnsFirewallSuccess 29 => dnsFirewallCustomerRatelimit 31 => dnsFirewallUpstreamFailure 32 => dnsFirewallUpstreamServfail |
customResolverTimeInMs | time took for custom resolver to respond |
datetime | The date and time the DNS query was resolved |
locationId | The uuid identifying the customer Location used when resolving |
queryName | Name of the query, e.g. one.dash.cloudflare.com |
resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
AccountGatewayResolverByCustomResolverGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayResolverByCustomResolverGroupsMax
Field | Description |
---|---|
customResolverTimeInMs | Maximum response time |
AccountGatewayResolverByCustomResolverGroupsOrderBy
Field | Description |
---|---|
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroups
Total time spent on executing firewall rules at the edge
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | The number of Gateway Resolver queries |
dimensions | List of dimensions to group by |
max | Maximum execution time |
quantiles | Quantiles of a rule execution performance |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsDimensions
Field | Description |
---|---|
datetime | Request timestamp |
datetimeMonth | Request timestamp month |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsMax
Field | Description |
---|---|
executionTime | Maximum execution time |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsQuantiles
Field | Description |
---|---|
executionTimeMsP25 | Execution time performance of 25th percentile in milliseconds |
executionTimeMsP50 | Execution time performance of 50th percentile in milliseconds |
executionTimeMsP75 | Execution time performance of 75th percentile in milliseconds |
executionTimeMsP90 | Execution time performance of 90th percentile in milliseconds |
executionTimeMsP95 | Execution time performance of 95th percentile in milliseconds |
executionTimeMsP98 | Execution time performance of 98th percentile in milliseconds |
executionTimeMsP99 | Execution time performance of 99th percentile in milliseconds |
AccountGatewayResolverQueriesAdaptiveGroups
BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling
Field | Description |
---|---|
count | The number of Gateway Resolver queries |
dimensions | List of dimensions to group by |
AccountGatewayResolverQueriesAdaptiveGroupsDimensions
Field | Description |
---|---|
authoritativeNameserverIps | List of IPs of the authoritative nameservers that provided the answers, if any |
categoryIds | Json array of categories for this query |
categoryNames | List of matching categories names for this query |
cnames | List of resolved intermediate cname domains |
datetime | The date and time the DNS query was resolved |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to minutes |
dohSubdomain | The destination DoH subdomain the DNS query was made to |
dotSubdomain | The destination DoT subdomain the DNS query was made to |
edeErrors | List of returned Extended DNS Error Codes |
locationId | The uuid identifying the customer Location used when resolving |
locationName | The name identifying the customer Location used when resolving |
matchedApplicationId | ID of the application the domain belongs to |
matchedApplicationName | Name of the application the domain belongs to |
matchedIndicatorFeedIds | Json array of indicator feed IDs for this query that matched rule |
matchedIndicatorFeedNames | List of indicator feed names for this query |
policyId | ID of the policy/rule that was applied, if any |
policyName | Name of the policy that was applied, if any |
queryName | Name of the query, e.g. one.dash.cloudflare.com |
queryNameReversed | Name of the query in reverse order, e.g. com.cloudflare.dash.one |
resolvedIpContinents | Continent code of each resolved IP, if any |
resolvedIpCountries | Country code of each resolved IP, if any |
resolvedIps | List of resolved IPs in the response, if any |
resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
resourceRecordClasses | Resource records' classes |
resourceRecordNames | Resource records' names |
resourceRecordRDatas | Resource records' rdata values |
resourceRecordTTLs | Resource records' TTL values |
resourceRecordTypes | Resource records' types |
scheduleInfo | Json object of schedule releated information |
srcIpContinent | Continent code of the source IP address making the DNS query |
srcIpCountry | Country code of the source IP address making the DNS query |
AccountGatewayResolverQueriesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayResolverQueriesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequests1dGroups
Daily rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1dGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
AccountHttpRequests1dGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
AccountHttpRequests1dGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
AccountHttpRequests1dGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
AccountHttpRequests1dGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
AccountHttpRequests1dGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
AccountHttpRequests1dGroupsDimensions
Field | Description |
---|---|
date | Request date |
AccountHttpRequests1dGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequests1dGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
AccountHttpRequests1dGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequests1dGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
AccountHttpRequests1dGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
AccountHttpRequests1dGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
AccountHttpRequests1dGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
AccountHttpRequests1hGroups
Hourly rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1hGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
AccountHttpRequests1hGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
AccountHttpRequests1hGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
AccountHttpRequests1hGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
AccountHttpRequests1hGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
AccountHttpRequests1hGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
AccountHttpRequests1hGroupsDimensions
Field | Description |
---|---|
date | Request date |
datetime | Request datetime truncated to the hour |
AccountHttpRequests1hGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequests1hGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
AccountHttpRequests1hGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequests1hGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
AccountHttpRequests1hGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
AccountHttpRequests1hGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
AccountHttpRequests1hGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
AccountHttpRequests1mGroups
Minutely rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1mGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
AccountHttpRequests1mGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
AccountHttpRequests1mGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
AccountHttpRequests1mGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
AccountHttpRequests1mGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
AccountHttpRequests1mGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
AccountHttpRequests1mGroupsDimensions
Field | Description |
---|---|
date | Request date |
datetime | Request datetime, truncated to the minute |
datetimeDay | Request datetime truncated to the day |
datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
datetimeHour | Request datetime truncated to the hour |
datetimeMinute | DEPRECATED (Field is replaced with datetime ): Request datetime truncated to the minute |
AccountHttpRequests1mGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequests1mGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
AccountHttpRequests1mGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequests1mGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
AccountHttpRequests1mGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
AccountHttpRequests1mGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
AccountHttpRequests1mGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
AccountHttpRequestsAdaptive
Raw HTTP requests with adaptive sampling
Field | Description |
---|---|
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botManagementDecision | Judgement of the bot management system |
botScore | The final score originated from bot management detections. |
botScoreBucketBy10 | Range of the bot management score |
botScoreSrcName | Name of the source detection which generated the bot management score. |
cacheReserveUsed | Used Cache Reserve to serve the response |
cacheStatus | Cache status |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientDeviceType | |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientRefererHost | The referrer host |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | HTTP method of client request |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | Query parameters of client request |
clientRequestReferer | HTTP request referrer |
clientRequestScheme | The url scheme requested by the visitor |
clientSSLProtocol | SSL protocol version |
coloCode | |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
edgeResponseContentTypeName | |
edgeResponseStatus | HTTP response status code returned to browser |
edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
originASN | |
originASNDescription | ASN associated with origin |
originIP | |
originResponseDurationMs | |
originResponseStatus | HTTP origin response status code returned to browser |
rayName | The RayId of the request |
requestSource | |
securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
securitySource | The Cloudflare security product triggered by this request |
upperTierColoName | |
userAgent | visitor's user-agent string |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
xRequestedWith | The X-Requested-With header of the client request |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
AccountHttpRequestsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountHttpRequestsAdaptiveGroups
Aggregated HTTP requests data with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
confidence | ALPHA - DO NOT USE |
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
ratio | The ratio of a range of status codes, between 0 and 1 |
sum | The sum of values for a metric per dimension |
AccountHttpRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
crossZoneSubrequests | The proportion of requests that were inititiated by a Cloudflare Worker on another zone |
edgeDnsResponseTimeMs | |
edgeTimeToFirstByteMs | |
originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
sampleInterval |
AccountHttpRequestsAdaptiveGroupsConfidence
Field | Description |
---|---|
count | The number of values for a metric per dimension, with confidence intervals |
level | Confidence level that was requested |
sum | The sum of values for a metric per dimension, with confidence intervals |
AccountHttpRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botManagementDecision | Judgement of the bot management system |
botScore | The final score originated from bot management detections. |
botScoreBucketBy10 | Range of the bot management score |
botScoreSrcName | Name of the source detection which generated the bot management score. |
cacheReserveUsed | Used Cache Reserve to serve the response |
cacheStatus | |
clientASNDescription | The ASN of the visitor as string |
clientAsn | |
clientCountryName | Country from which request originated |
clientDeviceType | |
clientIP | |
clientRefererHost | The referrer host |
clientRequestHTTPHost | Host requested by the client |
clientRequestHTTPMethodName | HTTP method of client request |
clientRequestHTTPProtocol | HTTP protocol version |
clientRequestPath | Path of client request |
clientRequestQuery | Query parameters of client request |
clientRequestReferer | HTTP request referrer |
clientRequestScheme | HTTP request URI scheme (http/https) |
clientSSLProtocol | SSL protocol version |
coloCode | |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
edgeResponseContentTypeName | |
edgeResponseStatus | |
edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
originASN | |
originASNDescription | ASN associated with origin |
originIP | |
originResponseDurationMs | |
originResponseStatus | HTTP response status code returned by the origin |
requestSource | |
sampleInterval | ABR sample interval |
securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
securitySource | The Cloudflare security product triggered by this request |
upperTierColoName | |
userAgent | |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
xRequestedWith | The X-Requested-With header of the client request |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
AccountHttpRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequestsAdaptiveGroupsQuantiles
Field | Description |
---|---|
edgeDnsResponseTimeMsP50 | 50th percentile DNS Response Time (milliseconds) |
edgeDnsResponseTimeMsP95 | 95th percentile DNS Response Time (milliseconds) |
edgeDnsResponseTimeMsP99 | 99th percentile DNS Response Time (milliseconds) |
edgeTimeToFirstByteMsP50 | 50th percentile Time To First Byte (milliseconds) |
edgeTimeToFirstByteMsP95 | 95th percentile Time To First Byte (milliseconds) |
edgeTimeToFirstByteMsP99 | 99th percentile Time To First Byte (milliseconds) |
originResponseDurationMsP50 | 50th percentile Origin Response Duration (milliseconds) |
originResponseDurationMsP95 | 95th percentile Origin Response Duration (milliseconds) |
originResponseDurationMsP99 | 99th percentile Origin Response Duration (milliseconds) |
AccountHttpRequestsAdaptiveGroupsRatio
Field | Description |
---|---|
status4xx | |
status5xx |
AccountHttpRequestsAdaptiveGroupsSum
Field | Description |
---|---|
botDetectionIdArray | Array of bot management detection ids |
botDetectionIdCountArray | Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index. |
botDetectionTagArray | Array of bot management detection tags |
botDetectionTagCountArray | Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index. |
crossZoneSubrequests | The number of requests that were inititiated by a Cloudflare Worker on another zone |
edgeDnsResponseTimeMs | |
edgeResponseBytes | |
edgeTimeToFirstByteMs | |
originResponseDurationMs | |
visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
AccountHttpRequestsAdaptiveGroupsSumConfidence
Field | Description |
---|---|
edgeResponseBytes | Confidence interval for the corresponding point estimate |
AccountHttpRequestsAdaptiveJa4SignalsElem
Field | Description |
---|---|
signalName | Signal name |
signalValue | Signal value |
AccountHttpRequestsAdaptiveOrderBy
Field | Description |
---|---|
AccountHttpRequestsOverviewAdaptiveGroups
A high-level summary of HTTP requests made by end users.
Field | Description |
---|---|
avg | The average value for a metric per dimension |