Firewall notifications for active attack spikes
Cloudflare's application security features — the WAF, firewall rules, and rate limiting — have always operated silently, blocking malicious traffic without generating alerts. That changes today with the introduction of two new notification types for Business and Enterprise customers that trigger when firewall-related event volumes spike, indicating a probable attack in progress.
Notifications can be delivered via email, PagerDuty, or webhooks, and are configured from the Notifications tab in the Cloudflare dashboard.
Two new alert types
Security Events Alert is available for Business and Enterprise zones and fires on any spike in firewall events across all products and services. Alerts arrive within two hours of mitigation.
Advanced Security Events Alert is limited to Enterprise zones and supports filtering by specific security services, with separate notifications configurable per service. These alerts fire within five minutes of mitigation.
Baseline detection without fixed thresholds
Simple threshold-based alerting — "notify me if there are more than X events" — is impractical for firewall traffic because no universal baseline exists. An origin with many firewall rules will naturally produce more events than one with few. For origin error rate notifications, Cloudflare used the SLO alerting methodology from the Google SRE Handbook, but that approach assumes a known allowable error percentage, which doesn't apply here.
Instead, the new security event notifications use Z-score calculations to measure how many standard deviations the current event count sits from the mean for each Internet property. The initial iteration configures a Z-score threshold of 3.5, which Cloudflare says will be tuned based on customer feedback.
Configuration walkthrough
To set this up, open the Notifications tab in the dashboard, click "Add," and select either Security Events Alert or Advanced Security Events Alert. As with other Cloudflare notifications, you can assign a name and description, choose delivery channels, and select the domains to monitor.
For Advanced Security Events Alerts, you can also select which firewall services the notification monitors. The relevant service value from Firewall Event logs is shown alongside each option so you can match events when integrating with existing SIEM systems.
Alerts include details on the service that detected the events (such as the WAF), the timestamp, and the affected zone. A link routes you to the Firewall Events dashboard pre-filtered to the correct service and time window.
Cloudflare positions these notifications as an initial step toward a broader incident management system embedded in the dashboard, with more application security alert features planned.
