Monitoring Cloudflare Security Events

Cloudflare’s edge sees every request before the origin does, making it the highest-signal location to spot attacks. The Security Events dashboard (formerly Firewall Events) and Logpush are the primary tools for surfacing and acting on attacker behavior.

Security Events Dashboard

Located under Security -> Events per zone. Surfaces every action taken by:

Managed Rulesets (Cloudflare Managed, OWASP CRS, Exposed Credentials)
Custom Rules (Firewall Rules)
Rate-Limit Rules
Bot Fight Mode / Bot Management
DDoS protection
Access (zero-trust auth)
IP Access Rules (allowlist / blocklist)
Country-level rules

Each event row includes: timestamp, action (block, challenge, log, skip, allow), rule ID and ruleset, source IP, source AS, country, host, URI, user agent, and ray ID.

Identifying Attack Patterns

Useful filters when triaging events:

Signal	What It Tells You
Source country	Concentration in unexpected geographies suggests targeted scanning.
Source AS (Autonomous System)	Specific ASNs (e.g. cheap VPS providers, residential proxy networks) often correlate with abuse.
User-Agent	Empty UA, library defaults (`python-requests/`, `curl/`, `Go-http-client/`), or known scanner UAs (`sqlmap`, `nikto`, `masscan`).
Request URI	Probing for known vulnerable paths (`/.env`, `/wp-admin`, `/phpmyadmin`, `/.git/config`).
Volume per IP / per ASN	Bursts of identical requests across many IPs in one AS = botnet.
JA3 / JA4 fingerprint (Enterprise)	TLS-level fingerprints survive UA rotation and reveal automated clients.
Rule ID hit pattern	A spread across CRS sub-rules = generic scanner. Repeats on one rule = targeted exploit attempt.

Bot Management Insights

Cloudflare scores every request 0–99 for bot likelihood (cf.bot_management.score):

Score	Meaning
1	Almost certainly automated
2–29	Likely automated
30–99	Likely human

Additional signals:

cf.bot_management.verified_bot — known good crawler (Googlebot, Bingbot, etc., verified by reverse-DNS).
cf.bot_management.static_resource — request is for an asset, lower bot signal value.
cf.bot_management.ja3_hash / ja4 — TLS fingerprint clusters.

Bot Management requires Enterprise. Bot Fight Mode (free-tier) is a coarser binary — does no scoring, just challenges suspected bots.

Common Attack Types Visible at the Edge

Attack	How It Appears
Credential stuffing	High volume of `POST /login` from many low-bot-score IPs, often distributed across one or two ASNs, often missing CSRF tokens or reusing session IDs. Mitigated effectively with MFA.
SQLi probes	CRS rule 942xxx hits, payloads in query strings or POST bodies (`' OR '1'='1`, `UNION SELECT`, `sleep(5)`).
XSS probes	CRS rule 941xxx hits, `<script>`, `onerror=`, `javascript:` in parameters.
Path traversal	CRS rule 930xxx hits, `../`, `..%2f`, `%2e%2e/`.
Scrapers	High-volume `GET` against catalog/listing pages, no JS execution, sequential pagination, identical UA.
Vulnerability scanners	CRS rule 913xxx (scanner detection), broad rule-ID spread, requests for `/admin`, `/.git`, `/config`, `/backup.zip`.
DDoS (L7)	Spike in requests-per-second, often automated mitigation kicks in before custom rules fire.
L7 amplification	Slow-loris-style holds, unusual `Range:` headers, `HEAD` flood.

Acting on Findings

Move up the response ladder based on signal strength:

1. IP Allowlist / Blocklist

Single-IP precision actions via IP Access Rules:

Action: Block
IP: 203.0.113.42
Notes: SQLi probe burst 2026-04-28 — ticket SEC-1234

Useful for known malicious actors, but trivial for attackers to evade by rotating IPs.

2. AS-Level Blocks

Block or challenge entire autonomous systems via Custom Rules:

(ip.geoip.asnum eq 14061 and not http.host eq "marketing.example.com")
  -> Action: Managed Challenge

Effective when one AS is the source of repeated abuse. Beware of false positives — large ASNs (cloud providers) host plenty of legitimate traffic too.

3. Country Challenge / Block

(ip.geoip.country in {"XX" "YY"})
  -> Action: Managed Challenge

Blunt instrument; appropriate when business has no users in those geographies. Document the business rationale — legal/compliance teams will ask.

4. Custom WAF Rules

Surgical rules targeting specific attack signatures:

(http.request.uri.path eq "/login" and
 cf.bot_management.score lt 30 and
 ip.src in $known_proxies)
  -> Action: Managed Challenge

See Cloudflare WAF for rule design patterns.

5. Rate-Limit Rules

For abuse that doesn’t match a clean signature but exhibits volume patterns. See Rate Limiting:

(http.request.uri.path eq "/api/v1/search")
  -> Characteristics: ip.src
  -> Period: 60s, Requests: 120
  -> Action: Block, Mitigation timeout: 600s

Logs Export — Logpush

The Security Events dashboard retains data for a limited window (typically days, plan-dependent). For long-term analysis, compliance, or SIEM integration, use Logpush (Enterprise). Downstream SOAR platforms can automate response actions.

Destinations

AWS S3 / Cloudflare R2 — bulk archival, lake-house pattern
Splunk — direct ingest via HEC
Datadog / New Relic / Sumo Logic — observability platforms
Google Cloud Storage / Azure Blob
HTTP generic endpoint

Datasets Worth Pushing

Dataset	Why
`http_requests`	Full request log — gold for incident forensics. Volume is high — sample if needed.
`firewall_events`	Every WAF/Custom Rule action. Lower volume, high signal. Akin to CloudTrail for edge security.
`dns_logs`	DNS queries (where authoritative). Useful for tunneling detection.
`nel_reports`	Network Error Logs — client-side connectivity issues.
`access_requests`	Cloudflare Access auth events.

Retention Pattern

Push everything to S3/R2 for 1–2 years (cheap), and a filtered subset (firewall events + sampled HTTP logs) to a hot SIEM for 30–90 days of fast queries. Often paired with an ETL pipeline into a data lake for analytics, and alerts published into CloudWatch or EventBridge.

Sample Logpush Job

{
  "name": "cf-firewall-events-to-s3",
  "destination_conf": "s3://my-cf-logs/firewall_events?region=us-east-1",
  "dataset": "firewall_events",
  "enabled": true,
  "frequency": "high",
  "output_options": {
    "field_names": ["RayID", "ClientIP", "ClientASN", "ClientCountry",
                    "Action", "RuleID", "Source", "EdgeStartTimestamp",
                    "Host", "URI", "ClientRequestUserAgent"],
    "timestamp_format": "rfc3339"
  }
}

Operational Practices

Set up an alert on action = block rate spikes — a 10x increase usually means either an attack or a broken rule. Define thresholds tied to your SLO/SLI.
Alert on challenge_solve_rate drops for Bot Management — solved challenges falling means humans are being challenged, indicating false positives.
Weekly review of top-N rule IDs, source ASNs, and blocked URIs. Patterns emerge over time.
Correlate Cloudflare events with origin logs via the Ray ID (cf-ray header). Links edge action to origin behavior.
Annotate incidents in your runbook with the rules and rate-limits added in response — drift detection on these matters.

mgarden

Explorer