Native log analysis expands to Zero Trust data

Cloudflare’s Log Explorer, introduced in 2024, already let customers store and query HTTP and security event logs directly within the Cloudflare network. That capability now extends to the Zero Trust product suite, and customers can build custom dashboards to monitor suspicious or unusual activity without exporting data to third-party tools.

Log Explorer keeps Cloudflare logs for a 30-day retention period and provides a single interface for investigation inside the Cloudflare Dashboard. HTTP request logs carry client details such as IP address, autonomous system (ASN), request method, request path, and TLS version. Application Security’s WAF Detections enrich those logs with additional context, including the WAF attack score.

Seven Zero Trust datasets now available

Log Explorer now ingests logs from seven additional Cloudflare products:

  • Access
  • Gateway DNS
  • Gateway HTTP
  • Gateway Network
  • CASB
  • Zero Trust Network Session
  • Device Posture Results

These datasets open up investigation paths for common security scenarios. To spot unauthorized access attempts, for example, you can filter Access logs on the Allowed field.

A query in Log Explorer, selecting 6 columns of the Access requests dataset, filtering on the Allowed field

Cross-referencing those requests against HTTP logs can reveal whether bot networks are driving the unauthorized activity.

A query in Log Explorer, selecting 12 columns of the HTTP requests dataset, filtering on the BotScore, OriginResponseStatus, and ClientRequestPath fields

Findings from these queries can feed directly into Custom Rules that block the offending traffic.

Gateway logs also help detect compromised machines or accounts. Web Gateway tracks which websites users visit, so administrators can identify and block malicious sites. A rapid sequence of requests to known malicious hostnames — including domains using long random character strings to disguise their destination — is a signal worth investigating. A query can look for requests to a spoofed YouTube URL, for example.

A query in Log Explorer, selecting 7 columns of the Gateway DNS dataset, filtering on the QueryName field

Custom dashboards for targeted monitoring

Security monitoring needs vary by industry and threat model: retail and financial companies focus on fraud, while data exfiltration and PII theft are universal concerns. Custom dashboards let you define the specific metrics you need to monitor the threats relevant to your organization.

Dashboards can be built in two ways. A natural language interface, similar to the AI Assistant announced during Security Week 2024, lets you describe the chart you want in plain language and translates that into an appropriate chart configuration. You can enter a query like “Compare status code ranges over time” and the model selects the visualization. Alternatively, you can assemble charts manually, choosing the chart type, title, dataset, metrics, and filters for full control.

Pre-built templates provide a starting point for common use cases:

  • Bot monitoring: Identify automated traffic accessing your site
  • API Security: Monitor data transfer and exceptions on API endpoints
  • API Performance: View endpoint timing data alongside error rates
  • Account Takeover: Track login attempts, leaked credential usage, and takeover attacks
  • Performance Monitoring: Spot slow hosts and paths on your origin and review time to first byte (TTFB) metrics over time

Once a dashboard exists, charts can be added or removed using the same natural language chart creator.

An Account Takeover template dashboard, for example, can monitor suspicious login activity on your domain — the same scenario flagged through Access log queries.

Account takeover dashboard showing 5 charts for monitoring failed login requests, leaked credentials, failed login rate, time series of failed login requests, and distribution of leaked credentials.

Spikes in errors can signal an underlying problem, sometimes indicating unauthorized activity. The Performance Monitoring template shows origin response time, TTFB, and common error rates; a sudden rise in 404 errors, for instance, may indicate an unauthorized scan of your endpoints.

Performance monitoring dashboard showing 6 charts that monitor percent of traffic served by origin, percent of traffic mitigated by Cloudflare, cache hit ratio, origin response time percentiles, time to first byte percentiles, and distribution of common error codes on a time series chart.

Custom dashboards are integrated into the broader Cloudflare platform. If you spot a troublesome traffic pattern or error spike, a “View in Security Analytics” button drills into the underlying data, where you can craft custom WAF rules to mitigate the threat.

Zoomed in view of “View in Security Analytics” button available on all charts.

Roadmap and availability

Upcoming features in observability and forensics include custom alerts based on specific metrics or anomalies, scheduled log queries that run on a timer to detect malicious activity, and deeper integration across the Cloudflare platform to streamline the path from detection to mitigation.

Current Log Explorer beta users get immediate access to the new custom dashboards. Pricing is scheduled for general availability in Q2 2025; until then the features remain free. Interested parties can sign up for the beta program through Cloudflare’s Log Explorer form.