One dashboard for every zone on your account
Cloudflare’s security stack — WAF, Bot Management, DDoS protection, Zero Trust, and more — is typically configured as per-zone rules. That works well enough with one or two domains, but for Enterprise customers managing tens, hundreds, or even thousands of zones, checking each domain individually for traffic anomalies or rule hits is a serious time sink.
The Account WAF, introduced last September, addressed the configuration side by letting you deploy a single rule across every zone in your account. Now Cloudflare is extending the same philosophy to visibility with Account Security Analytics and Account Security Events. Both are now generally available to Enterprise customers.
What the two views do
Previously, account-wide visibility meant either opening each zone’s analytics dashboard one at a time or using the zone-level GraphQL Analytics API to aggregate data into your own dashboards. The new account-level views collapse that work into a single place in the dashboard, under Security Center in the sidebar.
Both views share familiar building blocks — sampled logs, filters across dimensions such as IP address, host, country, and ASN, plus the usual top-N breakdowns. Where they differ is in scope and purpose.
Account Security Events is narrowly focused on how each zone’s current security configuration is performing. Its main job is to make reviewing mitigated requests, i.e., rule matches, fast, which is essential for separating genuine attacks from false positives. The view breaks down activity by service (WAF, Firewall Rules, API Shield, and so on) and by action (allow, block, challenge).
Account Security Analytics takes the wider angle: it shows all HTTP traffic across all zones under the account, whether that traffic was mitigated by a security rule or passed through untouched. That makes it the right tool for hunting false negatives, tuning configurations, and vetting new zones as they come online. The view includes quick filters for cases Cloudflare’s heuristics flag as interesting, and many components parallel the zone-level Security Analytics view.
Following a traffic spike from detection to mitigation
To see how the two views work together, consider a typical investigation that starts from Analytics and then drops into Security Events to confirm the mitigation details.
Step 1: Sign in and pick the account; Security Analytics and Security Events sit under Security Center in the sidebar.
Step 2: If the timeseries shows a sharp spike, zoom into the interval and expand the top-N panels at the top of the page. Several details can confirm whether you are dealing with a layer 7 DDoS attack.
The indicators, in this case, line up clearly: the spike is distributed across many source IPs rather than concentrated on a single one, the edge status codes show a rate limiting rule was applied, and the traffic is GET requests over HTTP/2. The “Attack Analysis” panel reports the traffic clean of XSS, SQLi, and common RCE attempts, while the Bot Analysis panel flags the traffic as automated based on Bot Scores distribution. That combination — clean requests, high volume, many source IPs — points to a volumetric attack aimed at taking the application down rather than exploiting it.
Step 3: To check whether existing rules covered the attack or to fine-tune the configuration, add filters that fingerprint the suspicious traffic: by referer, path, HTTP method, query string, or by bot score for automated traffic.
Step 4: Switch to Security Events to zoom in on the mitigation actions taken on that fingerprint. A spike like this one may be handled by two actions, such as Managed Challenge and Block.
The events view also shows which configuration layers did the work — Firewall rules, DDoS configurations — and surfaces the exact rules that matched in the top events.
Availability and prerequisites
Both views are available this week to all Enterprise customers. Cloudflare recommends having Account Bot Management, WAF Attack Score, and Account WAF enabled to get the full visibility and action capabilities. The feature is currently in beta, and Cloudflare is asking users to test the views in the dashboard and share feedback for planned improvements.
