Plain-Language Queries for Security Analytics

Cloudflare has added an AI assistant to its Security Analytics dashboard, letting customers interrogate HTTP request and security event data with natural language instead of building complex filter chains. The assistant translates questions such as “Compare attack traffic between US and UK” or “Compare traffic across major web browsers” into structured queries and renders the results as time series charts.

The feature is built on Cloudflare’s Workers AI inference platform. A large language model converts the customer’s question into a set of GraphQL filters; those filters are then run against the Security Analytics dataset via the GraphQL API, and the returned data is plotted as a visualization. Because the LLM only ever sees the structured filter output — never the underlying security events — customer data is not exposed to the model, queries are not used for training, and both the query and the resulting data stay within Cloudflare’s network.

Why Natural Language Matters

Traditional dashboards constrain analysis to what the underlying database indexing and filter fields allow. Comparing two unrelated time series — say, traffic from a single IP address against automated traffic from Germany — previously required opening multiple tabs and running separate filtered views. The AI assistant removes this limitation by constructing the required filters automatically and can plot multiple data series on a single graph for side-by-side comparison.

The assistant works alongside the existing Security Analytics filters and is available directly from the dashboard. Example queries are provided to help users get started. Suggested use cases include:

  • Finding the source of attack traffic: “Compare attack traffic between US and UK”
  • Diagnosing errors: “Compare origin and edge 5xx errors”
  • Understanding client mix: “Compare traffic by each HTTP version”
  • An ecommerce site comparing endpoints: “Compare traffic between /api/login and /api/basket”
  • Spotting bot activity: “Show requests to /api/basket with a bot score less than 20”
  • Uncovering automated abuse: “Show POST requests to /admin with a Bot Score over 30”

How the Translation Works

Cloudflare’s approach avoids needing to teach the model about every possible query. By instructing the LLM about the available filterable fields in the Security Analytics GraphQL schema, the model can map a request like “Compare attack traffic on /api and /admin endpoints” into a matching set of structured filters. Those filters are then used to call the GraphQL APIs, retrieve the data, and build the chart.

This design keeps the complexity of unconstrained comparisons out of the dashboard’s query engine, and shifts the work to the AI assistant instead of requiring new backend indexing capabilities.

Beta Rollout and Roadmap

The beta launches for a small group of users immediately and expands to all Business and Enterprise customers through March. The ability to handle requests is limited at this stage to basic inquiries that produce a plot — queries that map to “show me” or “compare” over any currently filterable field are expected to work. More complex asks may not be handled yet.

Cloudflare says future versions will likely support higher-level questions such as “Did I experience any attacks yesterday?” and may use the assistant to auto-generate WAF rules for mitigation. Pricing is still to be determined before general availability.