Security Analytics: A Full-Traffic Security View

Applications behind Cloudflare already benefit from a broad set of security controls, from WAF and Bot Management to DDoS mitigation. The problem has always been visibility: the existing Security Events dashboard shows you what got blocked, but it doesn't tell you much about the rest of your traffic. With the introduction of the WAF Attack Score, Cloudflare is also launching Security Analytics, a new dashboard designed to give you a security-oriented view of every HTTP request, not just the ones that triggered a rule.

Detect First, Mitigate Second

Security Analytics is built around a “detect then mitigate” philosophy. Instead of forcing you to guess which rules to enable — and risk false positives — the new dashboard enriches every request with security signals from Cloudflare's analysis engines. Whether it's bot scoring, attack detection, or content scanning, you can see the results across your entire traffic before deciding what to block.

The approach isn't entirely new. Bot Management has relied on a similar model for years, and early access customers of the new analytics have reported that the added visibility shortens the path to confidently activating blocking rules. The goal is to give you a clear picture of what's happening before you commit to any active mitigation.

A New Dashboard Layout

Security Analytics reuses familiar analytics components — top N statistics, quick filters, and interactive charts — but puts them in a layout designed for rapid exploration. The core difference from Security Events lies in the dataset: Security Analytics draws from sampled HTTP requests covering your entire site, while Security Events only shows matches from active security rules.

Starting with a Focus

The page leads with top N statistics spanning request sources and destinations, allowing you to zero in on a specific segment of your application quickly. The intent is to answer questions like “How well protected is my admin area?” with a few clicks rather than a complicated query.

From there, the main trend chart plots mitigated versus non-mitigated requests over time. Spikes in the non-mitigated line that don't correspond to similar bumps in the mitigated one can signal that an attack didn't match any enabled rule. In that case, a single click on the chart filters the rest of the page to only those unruly requests, letting you investigate further.

Beyond the default view, the chart can be reconfigured to plot trends by attack analysis or bot analysis scores, making it easier to spot anomalies in automated or human-driven traffic.

Combining Security Signals

Security Analytics brings multiple detection signals into one view: bot scores, WAF Attack Scores, and content scanning results. Combining these lets you ask questions that were previously difficult to answer, such as:

  • Which attack requests are coming from automated sources?
  • Which likely attacks are being made by humans?
  • Are bots uploading content that might be malicious?

Applying a filter for any of these scenarios updates every visualization on the page — top N stats, the trend chart, and the sampled log — so you can confirm anomalies from any angle.

Deep-Diving into Sampled Logs

The sampled logs give you the per-request detail needed to follow up on suspicious activity. The expanded view has been redesigned to start with Cloudflare's response to the request, follow with an analysis of the signals, and end with the raw request components. That structure makes it clearer to validate your suspicions and decide on a course of action.

Built-in Starting Points

Flexibility can create its own friction, so Cloudflare added an “insights” panel with preset views. Clicking any one applies a set of filters that jump straight to a specific perspective on your traffic, saving time while not preventing you from further fine-tuning. Internal testing found this workflow efficient enough to serve as a starting point for many investigations.

Rollout and Availability

Security Analytics is being rolled out progressively to Enterprise customers who have purchased the new Application Security Core or Advanced Bundles. The broader customer base will receive access later, and the new dashboard will sit alongside the existing Security Events view rather than replacing it.

For enterprise users who want faster access, contacting your account team is the direct path to getting started.