Why single-source log analysis falls short in attack investigations
Security incidents rarely unfold through one vector alone. Attackers typically combine techniques: scanning public APIs for weaknesses, generating network noise to distract defenders, and abusing stolen credentials against internal applications. Investigating these multi-vector campaigns requires correlating telemetry across the entire stack.
Cloudflare Log Explorer now supports 14 datasets spanning the full Application Services and Cloudflare One portfolios. By joining HTTP request data, network-layer DDoS and Firewall logs, and Zero Trust Access events, security analysts can track an attack from initial reconnaissance to data exfiltration, cutting Mean Time to Detect (MTTD) in the process.
The edge as a single observation point
Because Cloudflare sits between users and origin servers, every request hitting a protected property is logged before it reaches infrastructure. Log Explorer centralizes these records, acting as a flight recorder for application traffic, security events, and network activity. Zone-scoped logs cover website traffic, security events, and edge performance, while account-scoped logs track Zero Trust, administrative changes, and network activity across the broader environment.
HTTP Requests | As the most comprehensive dataset, it serves as the "primary record" of all application-layer traffic, enabling the reconstruction of session activity, exploit attempts, and bot patterns. |
|---|---|
Firewall Events | Provides critical evidence of blocked or challenged threats, allowing analysts to identify the specific WAF rules, IP reputations, or custom filters that intercepted an attack. |
DNS Logs | Identify cache poisoning attempts, domain hijacking, and infrastructure-level reconnaissance by tracking every query resolved at the authoritative edge. |
NEL (Network Error Logging) Reports | Distinguish between a coordinated Layer 7 DDoS attack and legitimate network connectivity issues by tracking client-side browser errors. |
Spectrum Events | For non-web applications, these logs provide visibility into L4 traffic (TCP/UDP), helping to identify anomalies or brute-force attacks against protocols like SSH, RDP, or custom gaming traffic. |
Page Shield | Track and audit unauthorized changes to your site's client-side environment such as JavaScript, outbound connections. |
Zaraz Events | Examine how third-party tools and trackers are interacting with user data, which is vital for auditing privacy compliance and detecting unauthorized script behaviors. |
Access Requests | Tracks identity-based authentication events to determine which users accessed specific internal applications and whether those attempts were authorized. |
|---|---|
Audit Logs | Provides a trail of configuration changes within the Cloudflare dashboard to identify unauthorized administrative actions or modifications. |
CASB Findings | Identifies security misconfigurations and data risks within SaaS applications (like Google Drive or Microsoft 365) to prevent unauthorized data exposure. |
Magic Transit / IPSec Logs | Helps network engineers perform network-level (L3) monitoring such as reviewing tunnel health and view BGP routing changes. |
Browser Isolation Logs | Tracks user actions inside an isolated browser session (e.g., copy-paste, print, or file uploads) to prevent data leaks on untrusted sites |
Device Posture Results | Details the security health and compliance status of devices connecting to your network, helping to identify compromised or non-compliant endpoints. |
DEX Application Tests | Monitors application performance from the user's perspective, which can help distinguish between a security-related outage and a standard performance degradation. |
DEX Device State Events | Provides telemetry on the physical state of user devices, useful for correlating hardware or OS-level anomalies with potential security incidents. |
DNS Firewall Logs | Tracks DNS queries filtered through the DNS Firewall to identify communication with known malicious domains or command-and-control (C2) servers. |
Email Security Alerts | Logs malicious email activity and phishing attempts detected at the gateway to trace the origin of email-based entry vectors. |
Gateway DNS | Monitors every DNS query made by users on your network to identify shadow IT, malware callbacks, or domain-generation algorithms (DGAs). |
Gateway HTTP | Provides full visibility into encrypted and unencrypted web traffic to detect hidden payloads, malicious file downloads, or unauthorized SaaS usage. |
Gateway Network | Tracks L3/L4 network traffic (non-HTTP) to identify unauthorized port usage, protocol anomalies, or lateral movement within the network. |
IPSec Logs | Monitors the status and traffic of encrypted site-to-site tunnels to ensure the integrity and availability of secure network connections. |
Magic IDS Detections | Surfaces matches against intrusion detection signatures to alert investigators to known exploit patterns or malware behavior traversing the network. |
Network Analytics Logs | Provides high-level visibility into packet-level data to identify volumetric DDoS attacks or unusual traffic spikes targeting specific infrastructure. |
Sinkhole HTTP Logs | Captures traffic directed to "sinkholed" IP addresses to confirm which internal devices are attempting to communicate with known botnet infrastructure. |
WARP Config Changes | Tracks modifications to the WARP client settings on end-user devices to ensure that security agents haven't been tampered with or disabled. |
WARP Toggle Changes | Specifically logs when users enable or disable their secure connectivity, helping to identify periods where a device may have been unprotected. |
Zero Trust Network Session Logs | Logs the duration and status of authenticated user sessions to map out the complete lifecycle of a user's access within the protected perimeter. |
Tracking the attack chain across layers
Public-facing reconnaissance shows up in application-layer datasets. Querying http_requests for EdgeResponseStatus codes 401, 403, or 404 from a single IP, or for requests to sensitive paths like /.env, /.git, or /wp-admin, reveals scanning behavior. At the network layer, magic_ids_detections logs provide packet-level visibility into signature-based threats across IP, TCP, and UDP. Analysts can look for a single SourceIP triggering multiple unique detections across many DestinationPort values in a short window, which often indicates tools like Nmap or SYN stealth scans.
While reconnaissance runs, attackers may launch a volumetric flood to obscure their activity. network_analytics_logs reveals whether a DDoS attack is being used as a smokescreen.
Payloads, identity, and exfiltration
Once a vulnerability is confirmed, attackers send malicious payloads. Security signals in http_requests and fw_events, such as WAFAttackScore, WAFSQLiAttackScore, FraudAttack, and ContentScanJobResults, flag requests containing SQL injection or malformed uploads. Checking the action, source, and ruleID fields in fw_events shows whether Cloudflare's managed rules blocked the attempt or if it reached the origin.
If a suspicious IP appears to have authenticated, searching access_requests by ClientIP confirms the compromise: a Decision: Allow entry for a sensitive internal app means the attacker holds valid credentials.
For data exfiltration, DNS tunneling is a common bypass technique. Instead of normal queries like google.com, logs show long, encoded strings. Indicators include high-entropy subdomains in QueryName, unusual record types in QueryType such as TXT, CNAME, or NULL, and a single ClientIP generating thousands of unique requests. Network-layer signatures in magic_ids_detections also flag protocol anomalies like ICMP or DNS tunneling in the SignatureMessage field.
Correlating events across datasets
Multi-stage attacks appear benign when each log source is examined in isolation. Log Explorer's Tabs feature supports concurrent queries across datasets, letting analysts pivot from one dataset to another based on results and trace the complete chain from entry to exfiltration.
Session hijacking after token theft
When authenticated traffic from an Access user suddenly resembles bot behavior, the session may be compromised. Analysts identify high-risk sessions in http_requests, then copy the associated RayID into access_requests to map the activity to a specific user account.
SELECT RayID, ClientIP, ClientRequestUserAgent, BotScore
FROM http_requests
WHERE date = '2026-02-22'
AND BotScore < 20
LIMIT 100
SELECT Email, IPAddress, Allowed
FROM access_requests
WHERE date = '2026-02-22'
AND RayID = 'INSERT_RAY_ID_HERE'Post-phishing command-and-control beaconing
A workstation compromised via a phishing email will often query a known malicious domain, then immediately generate an intrusion detection alert. The investigation path runs from email_security_alerts identifying the phishing campaign, to Access logs matching the recipient's email address to an internal IP, to gateway_dns showing that host querying the malicious domain.
SELECT Timestamp, Threatcategories, To, Alertreason
FROM email_security_alerts
WHERE date = '2026-02-22'
AND Threatcategories LIKE 'phishing'SELECT Email, IPAddress
FROM access_requests
WHERE date = '2026-02-22'
SELECT SrcIP, QueryName, DstIP,
FROM gateway_dns
WHERE date = '2026-02-22'
AND SrcIP = 'INSERT_IP_FROM_PREVIOUS_QUERY'
AND QueryName LIKE '%malicious_domain_name%'Zero Trust logins followed by internal scanning
A successful Access login from an unexpected location warrants immediate follow-up. Analysts find these in access_requests, then check magic_ids_detections to see whether that same IPAddress is now triggering network-level signatures, indicating lateral movement attempts inside the private network.
SELECT IPAddress, Email, Country
FROM access_requests
WHERE date = '2026-02-22'
AND Allowed = true
AND Country != 'US' -- Replace with your HQ countrySELECT SignatureMessage, DestinationIP, Protocol
FROM magic_ids_detections
WHERE date = '2026-02-22'
AND SourceIP = 'INSERT_IP_ADDRESS_HERE'Ingestion speed and extensibility
Cloudflare designed Log Explorer around JSON Schema, a standard format for describing data structure. That decision let the platform expand from HTTP Requests and Firewall Events to the full breadth of Cloudflare telemetry, including Zero Trust logs, network analytics, and email security alerts, without rearchitecting the ingestion pipeline. The same schema-driven approach could eventually accept customer-supplied structured data, allowing hybrid environments to query third-party logs and Cloudflare edge telemetry through the same SQL interface.
Log availability speed is equally critical. Increasing concurrency in the ingestion path removed bottlenecks that caused "noisy neighbor" slowdowns. As a result, P99 ingestion latency dropped by approximately 55 percent and P50 by 25 percent, reducing the delay between an edge event and its availability to SQL queries.
Future releases will add scheduled detection queries, allowing these investigations to run on a recurring basis. Log Explorer remains a work in progress, with updates tracked in the Cloudflare product changelog. Current access options include self-serve purchase from the dashboard or consultation for contract customers, with details in the Developer Documentation.
