GraphQL

This lists all of the available datasets and fields in Cloudflare's GraphQL API.

AccountAccessLoginRequestsAdaptiveGroups

Access login requests

FieldDescription
avg
count Number of access login API events processed
dimensions List of dimensions to group by

AccountAccessLoginRequestsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountAccessLoginRequestsAdaptiveGroupsDimensions

FieldDescription
appId Access application ID
approvingPolicyId Policy ID that approved the user
cfRayId CF ray id
country Country tag
date The date the access login event was emitted
datetime The date and time the access login event was emitted
datetimeMinute The date and time the access login event was emitted truncated to the minute
deviceId Device ID
hasExistingJWT Has existing JWT (0 = false, 1 = true)
hasGatewayEnabled Has Gateway enabled (0 = false, 1 = true)
hasWarpEnabled Has WARP enabled (0 = false, 1 = true)
identityProvider Identity provider
ipAddress User IP address
isSuccessfulLogin If the login was successful (0 = false, 1 = true)
mtlsCertSerialId MTLS certificate serial ID
mtlsCommonName MTLS common name
mtlsStatus MTLS status (may show error message if status is not successful)
serviceTokenId Service token ID
userUuid User UUID

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroups

Network analytics data for Advanced DNS Protection

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
dnsQueryName The requested domain name in the DNS query
dnsQueryType The query type in the DNS query
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroups

Network analytics data for Advanced TCP Protection

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountAiGatewayCacheAdaptiveGroups

AI Gateway Cache

FieldDescription
count Total number of requests for an account with caching enabled: including hits and misses
dimensions List of dimensions to group by

AccountAiGatewayCacheAdaptiveGroupsDimensions

FieldDescription
cacheOp Cache Hit or Miss: 1 = cache hit, 0 = cache miss
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
gateway Gateway name
model Which model was the request sent to
provider Which provider was the request sent to
tokensIn Number of tokens in the request
tokensOut Number of tokens in the response

AccountAiGatewayErrorsAdaptiveGroups

AI Gateway Errors

FieldDescription
count Number of errors
dimensions List of dimensions to group by

AccountAiGatewayErrorsAdaptiveGroupsDimensions

FieldDescription
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
gateway Gateway name
model Which models was the request sent to
provider Which provider was the request sent to

AccountAiGatewayRequestsAdaptiveGroups

AI Gateway Requests

FieldDescription
count Number of processed requests
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAiGatewayRequestsAdaptiveGroupsDimensions

FieldDescription
cached Was the response served from cache?: 1 = cache hit, 0 = cache misss
date The date when trigger was triggered
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
gateway Gateway name
model Which models was the request sent to
provider Which provider was the request sent to
rateLimited Was the request rate limited?: 1 = rate limit applied, 0 = rate limit not applied
tokensIn Number of tokens in the request
tokensOut Number of tokens in the response

AccountAiGatewayRequestsAdaptiveGroupsSum

FieldDescription
cachedTokensIn Sum of cached tokens in
cachedTokensOut Sum of cached tokens out
uncachedTokensIn Sum of uncached tokens in
uncachedTokensOut Sum of uncached tokens out

AccountAiInferenceAdaptive

AI Inference logs with adaptive sampling

FieldDescription
datetime The date when inferance was triggered
errorCode Error code
inferenceTimeMs Inference time ms
modelId ModelId that was trigger to inference
neurons Monetization unit
requestBytesIn Request size in bytes
requestBytesOut Request size out bytes
requestSource Source who triggered (worker binding, pages binding, rest api)
sampleInterval ABR sample interval

AccountAiInferenceAdaptiveGroups

Aggregated AI Inference logs with adaptive sampling

FieldDescription
count Total number of inferences for an account
dimensions List of dimensions to group by
sum

AccountAiInferenceAdaptiveGroupsDimensions

FieldDescription
date The date when starts the inference
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
errorCode Error code
inferenceTimeMs Inference time ms
modelId ModelId that was trigger to inference
neurons Monetization unit
requestBytesIn Request size in bytes
requestBytesOut Request size out bytes
requestSource Source who triggered (worker binding, pages binding, rest api)

AccountAiInferenceAdaptiveGroupsSum

FieldDescription
totalInferenceTimeMs Total inference time ms
totalNeurons Total neurons
totalRequestBytesIn Total bytes in per request
totalRequestBytesOut Total bytes out per request

AccountCdnNetworkAnalyticsAdaptiveGroups

Network analytics data for Cloudflare CDN traffic

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountCdnNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountCdnNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag Device tag associated with the destination IP of the packet
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationSystem Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag Device tag associated with the source IP of the packet
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet

AccountCdnNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountD1AnalyticsAdaptiveGroups

Beta. Aggregated D1 analytics with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Number of requests to D1 processed
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountD1AnalyticsAdaptiveGroupsAvg

FieldDescription
queryBatchResponseBytes The total number of bytes in the response, including all returned rows and metadata (average/mean).
queryBatchTimeMs Query batch response time in milliseconds (average/mean).
sampleInterval The average value used for sample interval

AccountD1AnalyticsAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date The date the D1 request was received
datetimeFifteenMinutes The date and time the D1 request was received truncated to fifteen minutes
datetimeFiveMinutes The date and time the D1 request was received truncated to five minutes
datetimeHour The date and time the D1 request was received truncated to the hour
datetimeMinute The date and time the D1 request was received truncated to the minute

AccountD1AnalyticsAdaptiveGroupsQuantiles

FieldDescription
queryBatchResponseBytesP50 The total number of bytes in the response, including all returned rows and metadata (50th percentile).
queryBatchResponseBytesP90 The total number of bytes in the response, including all returned rows and metadata (90th percentile).
queryBatchTimeMsP50 Query batch response time in milliseconds (50th percentile).
queryBatchTimeMsP90 Query batch response time in milliseconds (90th percentile).

AccountD1AnalyticsAdaptiveGroupsSum

FieldDescription
queryBatchResponseBytes The total number of bytes in the response, including all returned rows and metadata.
readQueries The number of read queries.
rowsRead The number of rows your queries read.
rowsWritten The number of rows your queries wrote.
writeQueries The number of write queries.

AccountD1QueriesAdaptiveGroups

Beta. D1 query metrics with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Number of D1 queries processed
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountD1QueriesAdaptiveGroupsAvg

FieldDescription
queryDurationMs The average duration queries in D1 took, observed over the queried time period.
rowsRead The average number of rows scanned, observed over the queried time period.
rowsWritten The average number of rows written, observed over the queried time period.
sampleInterval The average value used for sample interval

AccountD1QueriesAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date D1 query sample timestamp
datetimeFifteenMinutes D1 query sample timestamp, truncated to fifteen minutes
datetimeFiveMinutes D1 query sample timestamp, truncated to five minutes
datetimeHour D1 query sample timestamp, truncated to the hour
datetimeMinute D1 query sample timestamp, truncated to the minute
query The SQL query that ran on a D1 database, with parameterized values replaced with placeholders.

AccountD1QueriesAdaptiveGroupsSum

FieldDescription
queryDurationMs The total duration queries in D1 took, observed over the queried time period.
rowsRead The total number of rows scanned, observed over the queried time period.
rowsWritten The total number of rows written, observed over the queried time period.

AccountD1StorageAdaptiveGroups

Beta. D1 storage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
max The max of values for a metric per dimension

AccountD1StorageAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date D1 storage sample timestamp
datetimeFifteenMinutes D1 storage sample timestamp, truncated to fifteen minutes
datetimeFiveMinutes D1 storage sample timestamp, truncated to five minutes
datetimeHour D1 storage sample timestamp, truncated to the hour
datetimeMinute D1 storage sample timestamp, truncated to the minute

AccountD1StorageAdaptiveGroupsMax

FieldDescription
databaseSizeBytes The maximum size of the database (measured in bytes) observed over the queried time period.

AccountDosdAttackAnalyticsGroups

Attack analytics metadata for attacks detected by dosd

FieldDescription
attackId Unique identifier of the mitigation that matched the packet, if any
attackType DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic
attackVector Description of attack vector
bits Sum of bits received during the attack
commonTcpFlags Common TCP flags used by attack traffic, if any
commonTcpFlagsNames Names of common TCP flags used by attack traffic, if any
destinationIp Fixed destination IP used by attack traffic, if any
destinationPort Fixed destination port used by attack traffic, if any
droppedBits Sum of bits dropped during the attack
droppedPackets Sum of packets dropped during the attack
endDatetime Date and time that the attack ended; not available for ongoing attacks
ipProtocol Fixed protocol used by attack traffic, if any
ipProtocolName Fixed protocol used by attack traffic, if any
mitigationReason Type of mitigation applied to attack traffic
mitigationScope Whether mitigation was applied in only some locations or globally
mitigationType Type of mitigation applied to attack traffic
packets Sum of packets received during the attack
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sourceIp Fixed source IP used by attack traffic, if any
sourcePort Fixed source port used by attack traffic, if any
startDatetime Date and time that the attack started
tcpFlags Fixed TCP flags used by attack traffic, if any
tcpFlagsNames Names of fixed TCP flags used by attack traffic, if any

AccountDosdNetworkAnalyticsAdaptiveGroups

Network analytics data for dosd

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountDosdNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountDosdNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
attackId Unique identifier of the mitigation that matched the packet, if any
attackVector Attack vector of the rule that matched the packet, if any
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountDosdNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountDurableObjectsInvocationsAdaptiveGroups

Durable Objects invocations with adaptive sampling

FieldDescription
avg The average value used for sample interval
dimensions List of dimensions to group by
max The max value for a metric
min The min value for a metric
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountDurableObjectsInvocationsAdaptiveGroupsAvg

FieldDescription
sampleInterval

AccountDurableObjectsInvocationsAdaptiveGroupsDimensions

FieldDescription
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of a minute
environmentName The name of the script environment
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string
scriptName The name of the script
status Status of the worker invocation

AccountDurableObjectsInvocationsAdaptiveGroupsMax

FieldDescription
responseBodySize Maximum response body size for one request - bytes
wallTime Maximum wall time for one request - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsMin

FieldDescription
responseBodySize Minimum response body size for one request - bytes
wallTime Minimum wall time for one request - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsQuantiles

FieldDescription
responseBodySizeP25 Response body size 25th percentile - bytes
responseBodySizeP50 Response body size 50th percentile - bytes
responseBodySizeP75 Response body size 75th percentile - bytes
responseBodySizeP90 Response body size 90th percentile - bytes
responseBodySizeP99 Response body size 99th percentile - bytes
responseBodySizeP999 Response body size 99.9th percentile - bytes
wallTimeP25 Wall time 25th percentile - microseconds
wallTimeP50 Wall time 50th percentile - microseconds
wallTimeP75 Wall time 75th percentile - microseconds
wallTimeP90 Wall time 90th percentile - microseconds
wallTimeP99 Wall time 99th percentile - microseconds
wallTimeP999 Wall time 99.9th percentile - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsSum

FieldDescription
errors Sum of errors
requests Sum of requests
responseBodySize Sum of response body sizes
wallTime Sum of wall time

AccountDurableObjectsPeriodicGroups

Durable Objects periodic metrics

FieldDescription
dimensions List of dimensions to group by
max The max value for a metric
sum The sum of values for a metric per dimension

AccountDurableObjectsPeriodicGroupsDimensions

FieldDescription
date Datetime the metrics period started, truncated to start of a day
datetimeHour Datetime the metrics period started, truncated to start of an hour
datetimeMinute Datetime the metrics period started, truncated to start of a minute
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string

AccountDurableObjectsPeriodicGroupsMax

FieldDescription
activeWebsocketConnections Maximum active websocket connections in the time window

AccountDurableObjectsPeriodicGroupsSum

FieldDescription
activeTime Sum of active time - microseconds
cpuTime Sum of CPU time - microseconds
duration Sum of Duration - GB*s
exceededCpuErrors Sum of CPU exceeded errors
exceededMemoryErrors Sum of memory exceeded errors
fatalInternalErrors Sum of fatal internal server errors
inboundWebsocketMsgCount Sum of incoming websocket messages
outboundWebsocketMsgCount Sum of outbound websocket messages
storageDeletes Sum of storage deletes
storageReadUnits Sum of storage reads - in 4KB units
storageWriteUnits Sum of storage writes - in 4KB units
subrequests Sum of subrequests

AccountDurableObjectsStorageGroups

Durable Objects storage metrics

FieldDescription
dimensions List of dimensions to group by
max The sum of values for a metric per dimension

AccountDurableObjectsStorageGroupsDimensions

FieldDescription
date Datetime that the storage usage was recorded, truncated to start of a day
datetimeHour Datetime that the storage usage was recorded, truncated to start of an hour

AccountDurableObjectsStorageGroupsMax

FieldDescription
storedBytes Max of stored bytes

AccountDurableObjectsSubrequestsAdaptiveGroups

Durable Objects subrequests with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountDurableObjectsSubrequestsAdaptiveGroupsDimensions

FieldDescription
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of a minute
environmentName The name of the script environment
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string
scriptName The name of the script

AccountDurableObjectsSubrequestsAdaptiveGroupsSum

FieldDescription
requestBodySizeUncached Outgoing Durable Objects fetch request body size in bytes where the request was not cached

AccountFbmAttackAnalyticsGroups

FBM analytics metadata for attacks detected by dosd

FieldDescription
attackId Unique identifier of the mitigation that matched the packet, if any
attackType DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic
attackVector Description of attack vector
bits Sum of bits received during the attack
commonTcpFlags Common TCP flags used by attack traffic, if any
commonTcpFlagsNames Names of common TCP flags used by attack traffic, if any
destinationIp Fixed destination IP used by attack traffic, if any
destinationPort Fixed destination port used by attack traffic, if any
droppedBits Sum of bits dropped during the attack
droppedPackets Sum of packets dropped during the attack
endDatetime Date and time that the attack ended; not available for ongoing attacks
ipProtocol Fixed protocol used by attack traffic, if any
ipProtocolName Fixed protocol used by attack traffic, if any
mitigationReason Type of mitigation applied to attack traffic
mitigationScope Whether mitigation was applied in only some locations or globally
mitigationType Type of mitigation applied to attack traffic
packets Sum of packets received during the attack
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sourceIp Fixed source IP used by attack traffic, if any
sourcePort Fixed source port used by attack traffic, if any
startDatetime Date and time that the attack started
tcpFlags Fixed TCP flags used by attack traffic, if any
tcpFlagsNames Names of fixed TCP flags used by attack traffic, if any

AccountFilter_InputObject

FieldDescription

AccountFirewallEventsAdaptive

Raw Firewall events with adaptive sampling

FieldDescription
action The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientIP The visitor's IP address (IPv4 or IPv6)
clientIPClass The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor
clientRefererHost The referer host
clientRefererPath The referer path requested by visitor
clientRefererQuery The referer query-string was requested by the visitor
clientRefererScheme The referer url scheme requested by the visitor
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName The HTTP method used by the visitor
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery The query-string was requested by the visitor
clientRequestScheme The url scheme requested by the visitor
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
edgeColoName The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus HTTP response status code returned to browser
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
kind The kind of event, currently only possible values are: firewall
leakedCredentialCheckResult The distinct result of checking for leaked credentials
matchIndex Rules match index in the chain
metadata Additional product-specific information. Metadata is organized in key:value pairs
originResponseStatus HTTP origin response status code returned to browser
originatorRayName The RayId of the request that issued the challenge/jschallenge
rayName The RayId of the request
ref The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId The Cloudflare security product-specific RuleId triggered by this request
rulesetId The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval ABR sample interval
source The Cloudflare security product triggered by this request
userAgent visitor's user-agent string
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneTag Associated zone
zoneVersion The version of a zone

AccountFirewallEventsAdaptiveGroups

Aggregated Firewall events with adaptive sampling

FieldDescription
avg The average value used for sample interval
count The sum of sample interval values
dimensions List of dimensions to group by

AccountFirewallEventsAdaptiveGroupsAvg

FieldDescription
sampleInterval

AccountFirewallEventsAdaptiveGroupsDimensions

FieldDescription
action The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientIP The visitor's IP address (IPv4 or IPv6)
clientIPClass The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor
clientRefererHost The referer host
clientRefererPath The referer path requested by visitor
clientRefererQuery The referer query-string was requested by the visitor
clientRefererScheme The referer url scheme requested by the visitor
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName The HTTP method used by the visitor
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery The query-string was requested by the visitor
clientRequestScheme The url scheme requested by the visitor
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
edgeColoName The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus HTTP response status code returned to browser
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
kind The kind of event, currently only possible values are: firewall
matchIndex Rules match index in the chain
originResponseStatus HTTP origin response status code returned to browser
originatorRayName The RayId of the request that issued the challenge/jschallenge
rayName The RayId of the request
ref The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId The Cloudflare security product-specific RuleId triggered by this request
rulesetId The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval ABR sample interval
source The Cloudflare security product triggered by this request
userAgent visitor's user-agent string
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneTag Associated zone
zoneVersion The version of a zone

AccountFirewallEventsAdaptiveMetadataElem

FieldDescription
key The key of the metadata. Key format can vary by Cloudflare security product and can change over time.
value The value of the metadata. Value format can vary by Cloudflare security product and can change over time.

AccountFlowtrackdNetworkAnalyticsAdaptiveGroups

Network analytics data for flowtrackd

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountGatewayL4DownstreamSessionsAdaptiveGroups

Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close

FieldDescription
count The number of downstream sessions
dimensions List of dimensions to group by
quantiles
sum

AccountGatewayL4DownstreamSessionsAdaptiveGroupsDimensions

FieldDescription
coloCode IATA Airport code that represents the city in which a Cloudflare data center (colo) is located
coloCountry ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located
date Start timestamp of this session, truncated to date
datetimeFifteenMinutes Start timestamp of this session, truncated to multiple of 15 minutes
datetimeFiveMinutes Start timestamp of this session, truncated to multiple of 5 minutes
datetimeHour Start timestamp of this session, truncated to the hour
datetimeMinute Start timestamp of this session, truncated to the minute
quicErrorCode QUIC specific error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes
rttUs Last Round Trip Time estimation for this session in microseconds
sessionId Identifier for this session
sourceIP IP address of the client making this session
tokenAuthStatus Client token authentication status. Possible values are success | failed with invalid token and upto date token key ID | failed with invalid token due to outdated/missing token key ID | failed due to reused token
tokenSigningRegion Broad location assigned to client in this session
transport Transport protocol used for this session. Possible values are tcp | quic | udp
transportHandshakeDurationUs Time taken for TCP/TLS or QUIC handshake in microsecond
transportStatus Transport Status. Possible values are unknown | success | failure

AccountGatewayL4DownstreamSessionsAdaptiveGroupsQuantiles

FieldDescription
tokenAuthDurationUsP50 Time taken for Client Token Authentication in microseconds
transportHandshakeDurationUsP50 Time taken for TCP/TLS or QUIC handshake in microseconds

AccountGatewayL4DownstreamSessionsAdaptiveGroupsSum

FieldDescription
bytesRecvd Total bytes received in this session
bytesSent Total bytes sent in this session
clientBytesRetransmitted Total bytes retransmitted by client in this session
packetsRecvd Total number of packets received in this session
packetsSent Total number of packets sent in this session
tokenAuthDurationUs Time taken for client token authentication in microseconds

AccountGatewayL4SessionsAdaptiveGroups

BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling

FieldDescription
count The number of Gateway L4 sessions
dimensions List of dimensions to group by

AccountGatewayL4SessionsAdaptiveGroupsDimensions

FieldDescription
action action taken by gateway
coloCode Colo Code of edge server
datetime Datetime that the session was started
datetimeHour Datetime that the session was started truncated to hours
datetimeMinute Datetime that the session was started truncated to minutes
destinationIp The destination IP address for the session
destinationPort The destination port for the session
detectedProtocol The detected protocol of network traffic
deviceId The device ID of the gateway user who initiated the session
email The email address of the gateway user who initiated the session
sni The SNI pulled from the session tls handshake, if present
sourceInternalIp Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp
sourceIp The source IP address for the session
sourcePort The source port for the session
transport The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp)
userId The ID of the gateway user who initiated the session

AccountGatewayL4UpstreamSessionsAdaptiveGroups

Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close

FieldDescription
count The number of upstream sessions
dimensions List of dimensions to group by
quantiles
sum

AccountGatewayL4UpstreamSessionsAdaptiveGroupsDimensions

FieldDescription
coloCode IATA Airport code that represents the city in which a Cloudflare data center (colo) is located
coloCountry ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located
date Start timestamp of this session, truncated to date
datetimeFifteenMinutes Start timestamp of this session, truncated to multiple of 15 minutes
datetimeFiveMinutes Start timestamp of this session, truncated to multiple of 5 minutes
datetimeHour Start timestamp of this session, truncated to the hour
datetimeMinute Start timestamp of this session, truncated to the minute
destinationIP IP address of the origin server
domainName SNI domain name for this session
downstreamSessionId Downstream session identifier of this session
httpConnectReqStatus Client HTTP CONNECT request status. Possible values are unknown | success | failure
quicErrorCode QUIC error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes
rttUs Last Round Trip Time estimation for this session in microseconds
tokenSigningRegion Broad location assigned to client in this session
totalTunnelSetupDurationUs Total time taken for tunnel setup in microseconds
transport Transport protocol used for this session. Possible values are tcp | quic | udp
transportStatus Transport status. Possible values are unknown | success | failure

AccountGatewayL4UpstreamSessionsAdaptiveGroupsQuantiles

FieldDescription
connectReqHandlingDurationUsP50 Time taken for CONNECT request handling in microseconds
totalTunnelSetupDurationUsP50 Total time taken for tunnel setup in microseconds
tunnelSetupDurationUsP50 Time taken to setup the tunnel in microseconds

AccountGatewayL4UpstreamSessionsAdaptiveGroupsSum

FieldDescription
bytesRecvd Total bytes received in this session
bytesSent Total bytes sent in this session
connectReqHandlingDurationUs Time taken for CONNECT request handling in microseconds
originBytesRetransmitted Total bytes retransmitted by origin in this session
packetsRecvd Total number of packets received in this session
packetsSent Total number of packets sent in this session
totalTunnelSetupDurationUs Total time taken for tunnel setup in microseconds
tunnelSetupDurationUs Time taken for tunnel setup in microseconds

AccountGatewayL7RequestsAdaptiveGroups

BETA - Aggregate counts of Gateway L7 requests with adaptive sampling

FieldDescription
count The number of Gateway L7 requests
dimensions List of dimensions to group by

AccountGatewayL7RequestsAdaptiveGroupsDimensions

FieldDescription
action action taken by gateway
coloCode Colo Code of edge server
datetime Datetime that the request happened
datetimeHour Datetime that the request happened truncated to hours
datetimeMinute Datetime that the request happened truncated to minutes
deviceId The device ID of the gateway user who made the request
email The email address of the gateway user who made the request
httpHost The destination host for the request
httpStatusCode HTTP status code gateway returned to the user. 0 if nothing was returned(e.g client disconnected)
isIsolated Indicates whether this request was made through an isolated link
sourceInternalIp Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp
untrustedCertificateAction Action taken when an untrusted origin certificate error occurs
userId The ID of the gateway user who made the request

AccountGatewayResolverByCategoryAdaptiveGroups

BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling

FieldDescription
count The number of Gateway Resolver queries
dimensions List of dimensions to group by

AccountGatewayResolverByCategoryAdaptiveGroupsDimensions

FieldDescription
categoryId ID of the category that was assigned to the domain
datetime The date and time the DNS query was resolved
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to minutes
locationId The uuid identifying the customer Location used when resolving
resolverDecision Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroups

Total time spent on executing firewall rules at the edge

FieldDescription
avg The average value for a metric per dimension
count The number of Gateway Resolver queries
dimensions List of dimensions to group by
max Maximum execution time
quantiles Quantiles of a rule execution performance

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsDimensions

FieldDescription
datetime Request timestamp
datetimeMonth Request timestamp month

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsMax

FieldDescription
executionTime Maximum execution time

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsQuantiles

FieldDescription
executionTimeMsP25 Execution time performance of 25th percentile in milliseconds
executionTimeMsP50 Execution time performance of 50th percentile in milliseconds
executionTimeMsP75 Execution time performance of 75th percentile in milliseconds
executionTimeMsP90 Execution time performance of 90th percentile in milliseconds
executionTimeMsP95 Execution time performance of 95th percentile in milliseconds
executionTimeMsP98 Execution time performance of 98th percentile in milliseconds
executionTimeMsP99 Execution time performance of 99th percentile in milliseconds

AccountGatewayResolverQueriesAdaptiveGroups

BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling

FieldDescription
count The number of Gateway Resolver queries
dimensions List of dimensions to group by

AccountGatewayResolverQueriesAdaptiveGroupsDimensions

FieldDescription
categoryIds Json array of categories for this query
datetime The date and time the DNS query was resolved
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to minutes
locationId The uuid identifying the customer Location used when resolving
matchedIndicatorFeedIds Json array of indicator feed IDs for this query that matched rule
queryName Name of the query, e.g. one.dash.cloudflare.com
queryNameReversed Name of the query in reverse order, e.g. com.cloudflare.dash.one
resolverDecision Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)
scheduleInfo Json object of schedule releated information

AccountHttpRequests1dGroups

Daily rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1dGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1dGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1dGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1dGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1dGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1dGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1dGroupsDimensions

FieldDescription
date Request date

AccountHttpRequests1dGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1dGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1dGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1dGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1dGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequests1hGroups

Hourly rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1hGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1hGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1hGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1hGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1hGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1hGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1hGroupsDimensions

FieldDescription
date Request date
datetime Request datetime truncated to the hour

AccountHttpRequests1hGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1hGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1hGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1hGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1hGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequests1mGroups

Minutely rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1mGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1mGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1mGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1mGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1mGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1mGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1mGroupsDimensions

FieldDescription
date Request date
datetime Request datetime, truncated to the minute
datetimeDay Request datetime truncated to the day
datetimeFifteenMinutes Request datetime truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime truncated to multiple of 30 minutes
datetimeHour Request datetime truncated to the hour
datetimeMinute DEPRECATED (Field is replaced with datetime): Request datetime truncated to the minute

AccountHttpRequests1mGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1mGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1mGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1mGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1mGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequestsAdaptive

Raw HTTP requests with adaptive sampling

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus Cache status
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientDeviceType
clientIP The visitor's IP address (IPv4 or IPv6)
clientRefererHost The referrer host
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme The url scheme requested by the visitor
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus HTTP response status code returned to browser
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP origin response status code returned to browser
requestSource
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent visitor's user-agent string
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneTag Associated zone
zoneVersion The version of a zone

AccountHttpRequestsAdaptiveGroups

Aggregated HTTP requests data with adaptive sampling

FieldDescription
avg The average value used for sample interval
confidence ALPHA - DO NOT USE
count The number of values for a metric per dimension
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
ratio The ratio of a range of status codes, between 0 and 1
sum The sum of values for a metric per dimension

AccountHttpRequestsAdaptiveGroupsAvg

FieldDescription
crossZoneSubrequests The proportion of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeTimeToFirstByteMs
originResponseDurationMs The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval

AccountHttpRequestsAdaptiveGroupsConfidence

FieldDescription
count The number of values for a metric per dimension, with confidence intervals
level Confidence level that was requested
sum The sum of values for a metric per dimension, with confidence intervals

AccountHttpRequestsAdaptiveGroupsDimensions

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus
clientASNDescription The ASN of the visitor as string
clientAsn
clientCountryName Country from which request originated
clientDeviceType
clientIP
clientRefererHost The referrer host
clientRequestHTTPHost Host requested by the client
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol HTTP protocol version
clientRequestPath Path of client request
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme HTTP request URI scheme (http/https)
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP response status code returned by the origin
requestSource
sampleInterval ABR sample interval
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneTag Associated zone
zoneVersion The version of a zone

AccountHttpRequestsAdaptiveGroupsQuantiles

FieldDescription
edgeDnsResponseTimeMsP50 50th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP95 95th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP99 99th percentile DNS Response Time (milliseconds)
edgeTimeToFirstByteMsP50 50th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP95 95th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP99 99th percentile Time To First Byte (milliseconds)
originResponseDurationMsP50 50th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP95 95th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP99 99th percentile Origin Response Duration (milliseconds)

AccountHttpRequestsAdaptiveGroupsRatio

FieldDescription
status4xx
status5xx

AccountHttpRequestsAdaptiveGroupsSum

FieldDescription
crossZoneSubrequests The number of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeResponseBytes
edgeTimeToFirstByteMs
originResponseDurationMs
visits The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

AccountHttpRequestsAdaptiveGroupsSumConfidence

FieldDescription
edgeResponseBytes Confidence interval for the corresponding point estimate

AccountHttpRequestsOverviewAdaptiveGroups

A high-level summary of HTTP requests made by end users.

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
ratio The ratio of a metric in comparison to the rest of the traffic, between 0 and 1
sum The sum of values for a metric per dimension

AccountHttpRequestsOverviewAdaptiveGroupsAvg

FieldDescription
originResponseDurationMs The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval Average sample interval

AccountHttpRequestsOverviewAdaptiveGroupsDimensions

FieldDescription
clientCountryName Country from which request originated
clientRequestHTTPProtocol HTTP protocol version
clientSSLProtocol SSL protocol version
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeResponseContentTypeName Content type returned to client
edgeResponseStatus HTTP response status code returned to client
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
userAgentBrowser Browser parsed from the user agent
zoneVersion The version of a zone

AccountHttpRequestsOverviewAdaptiveGroupsRatio

FieldDescription
cachedBytes
cachedRequests
encryptedBytes
encryptedRequests
status4xx
status5xx

AccountHttpRequestsOverviewAdaptiveGroupsSum

FieldDescription
bytes
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
pageViews Successful requests for HTML content
requests
visits The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

AccountHyperdriveQueriesAdaptiveGroups

Beta. Hyperdrive query events with adaptive sampling.

FieldDescription
avg The average value for a metric per dimension
count Total number of Hyperdrive queries
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountHyperdriveQueriesAdaptiveGroupsAvg

FieldDescription
queryBytes Average size (in bytes) of queries handled by Hyperdrive
resultBytes Average size (in bytes) of query results served by Hyperdrive
sampleInterval The average value used for sample interval

AccountHyperdriveQueriesAdaptiveGroupsDimensions

FieldDescription
cacheStatus The cache status of the Hyperdrive query events
configId The ID of the Hyperdrive Config
date Hyperdrive query event timestamp, truncated to start of a day
datetime Hyperdrive query event timestamp
datetimeHour Hyperdrive query event timestamp, truncated to start of hour
datetimeMinute Hyperdrive query event timestamp, truncated to start of minute

AccountHyperdriveQueriesAdaptiveGroupsSum

FieldDescription
queryBytes Total size (in bytes) of queries handled by Hyperdrive
resultBytes Total size (in bytes) of query results served by Hyperdrive

AccountImagesRequestsAdaptiveGroups

A high-level summary of Cloudflare Images served to end users.

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountImagesRequestsAdaptiveGroupsAvg

FieldDescription
sampleInterval

AccountImagesRequestsAdaptiveGroupsDimensions

FieldDescription
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute

AccountImagesRequestsAdaptiveGroupsSum

FieldDescription
requests

AccountImagesUniqueTransformations

Image unique transfromations per day

FieldDescription
date The date uniques are calculated for
transformations Number of unique image transformations per day in sliding window

AccountLogpushHealthAdaptiveGroups

Beta. Logpush job health metrics

FieldDescription
avg
count The number of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountLogpushHealthAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountLogpushHealthAdaptiveGroupsDimensions

FieldDescription
date Date that we completed pushing the log batch
datetime Datetime that we completed pushing the log batch
datetimeFifteenMinutes Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes
datetimeFiveMinutes Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes
datetimeHour Datetime that we completed pushing the log batch, truncated to the hour
datetimeMinute Datetime that we completed pushing the log batch, truncated to the minute
destinationType Destination type, e.g. 'S3' or 'GCS'
final Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true.
jobId The Logpush Job ID
status HTTP response status code of the log destination

AccountLogpushHealthAdaptiveGroupsSum

FieldDescription
bytes Bytes of uncompressed log data pushed
bytesCompressed Bytes of compressed log data pushed
records A count of the total number of records pushed.

AccountMagicFirewallNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic Firewall

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag Device tag associated with the destination IP of the packet
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
ruleId Unique identifier of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag Device tag associated with the source IP of the packet
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountMagicFirewallSamplesAdaptiveGroups

Data to visualize traffic allowed and blocked by Magic Firewall rules

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicFirewallSamplesAdaptiveGroupsDimensions

FieldDescription
datetime Date and time that the packet was received
datetimeFiveMinute Date and time that the packet was received, rounded to the start of the nearest five minutes
ruleId Unique identifier of the rule that matched the packet, if any

AccountMagicFirewallSamplesAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountMagicIDPSNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic IDS

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes