Network Analytics Logs
The descriptions below detail the fields available for network_analytics_logs.
| Field | Value | Type |
|---|---|---|
| AttackCampaignID | Unique identifier of the attack campaign that this packet was a part of, if any | string |
| AttackID | Unique identifier of the mitigation that matched the packet, if any | string |
| ColoCity | The city where the Cloudflare datacenter that received the packet is located | string |
| ColoCode | The Cloudflare datacenter that received the packet (nearest IATA airport code) | string |
| ColoCountry | The country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) | string |
| ColoGeoHash | The latitude and longitude where the colo that received the packet is located (Geohash encoding) | string |
| ColoName | The unique site identifier of the Cloudflare datacenter that received the packet (for example, ‘ams01’, ‘sjc01’, ‘lhr01’) | string |
| Datetime | The date and time the event occurred at the edge | int or string |
| DestinationASN | The ASN associated with the destination IP of the packet | int |
| DestinationASNName | The name of the ASN associated with the destination IP of the packet | string |
| DestinationCountry | The country where the destination IP of the packet is located (ISO 3166-1 alpha-2) | string |
| DestinationGeoHash | The latitude and longitude where the destination IP of the packet is located (Geohash encoding) | string |
| DestinationPort | Value of the Destination Port header field in the TCP or UDP packet | int |
| Direction | The direction in relation to customer network. Possible values are ingress | egress | string |
| GREChecksum | Value of the Checksum header field in the GRE packet | int |
| GREEtherType | Value of the EtherType header field in the GRE packet | int |
| GREHeaderLength | Length of the GRE packet header, in bytes | int |
| GREKey | Value of the Key header field in the GRE packet | int |
| GRESequenceNumber | Value of the Sequence Number header field in the GRE packet | int |
| GREVersion | Value of the Version header field in the GRE packet | int |
| ICMPChecksum | Value of the Checksum header field in the ICMP packet | int |
| ICMPCode | Value of the Code header field in the ICMP packet | int |
| ICMPType | Value of the Type header field in the ICMP packet | int |
| IPDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet | string |
| IPDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) | string |
| IPFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet | int |
| IPHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes | int |
| IPMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet | int |
| IPProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet | int |
| IPProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet | string |
| IPSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet | string |
| IPSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) | string |
| IPTTL | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet | int |
| IPTTLBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated | int |
| IPTotalLength | Total length of the IPv4 or IPv6 packet, in bytes | int |
| IPTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated | int |
| IPv4Checksum | Value of the Checksum header field in the IPv4 packet | int |
| IPv4DSCP | Value of the Differentiated Services Code Point header field in the IPv4 packet | int |
| IPv4DontFragment | Value of the Don’t Fragment header field in the IPv4 packet | int |
| IPv4ECN | Value of the Explicit Congestion Notification header field in the IPv4 packet | int |
| IPv4Identification | Value of the Identification header field in the IPv4 packet | int |
| IPv4Options | List of Options numbers included in the IPv4 packet header | string |
| IPv6DSCP | Value of the Differentiated Services Code Point header field in the IPv6 packet | int |
| IPv6ECN | Value of the Explicit Congestion Notification header field in the IPv6 packet | int |
| IPv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header | string |
| IPv6FlowLabel | Value of the Flow Label header field in the IPv6 packet | int |
| IPv6Identification | Value of the Identification extension header field in the IPv6 packet | int |
| MitigationReason | Reason for applying a mitigation to the packet, if any. Possible values are BLOCKED | RATE_LIMITED |UNEXPECTED | CHALLENGE_NEEDED | CHALLENGE_PASSED | NOT_FOUND | OUT_OF_SEQUENCE | ALREADY_CLOSED | string |
| MitigationScope | Whether the packet matched a local or global mitigation, if any. Possible values are local | global | string |
| MitigationSystem | Which Cloudflare system sampled the packet. Possible values are dosd | flowtrackd | magic-firewall | string |
| Outcome | The action that Cloudflare systems took on the packet. Possible values are pass | drop | string |
| ProtocolState | State of the packet in the context of the protocol, if any. Possible values are OPEN | NEW | CLOSING | CLOSED | string |
| RuleID | Unique identifier of the rule contained with the Cloudflare L3/4 managed ruleset that this packet matched, if any | string |
| RulesetID | Unique identifier of the Cloudflare L3/4 managed ruleset containing the rule that this packet matched, if any. Possible values are 3b64149bfa6e4220bbbc2bd6db589552 | string |
| RulesetOverrideID | Unique identifier of the rule within the accounts root ddos_l4 phase ruleset which resulted in an override of the default sensitivity or action being applied/evaluated, if any | string |
| SampleInterval | The sample interval is the inverse of the sample rate. For example, a sample interval of 1000 means that this packet was randomly sampled from 1 in 1000 packets. Sample rates are dynamic and based on the volume of traffic. | int |
| SourceASN | The ASN associated with the source IP of the packet | int |
| SourceASNName | The name of the ASN associated with the source IP of the packet | string |
| SourceCountry | The country where the source IP of the packet is located (ISO 3166-1 alpha-2) | string |
| SourceGeoHash | The latitude and longitude where the source IP of the packet is located (Geohash encoding) | string |
| SourcePort | Value of the Source Port header field in the TCP or UDP packet | int |
| TCPAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet | int |
| TCPChecksum | Value of the Checksum header field in the TCP packet | int |
| TCPDataOffset | Value of the Data Offset header field in the TCP packet | int |
| TCPFlags | Value of the Flags header field in the TCP packet | int |
| TCPFlagsString | Human-readable string representation of the Flags header field in the TCP packet | string |
| TCPMSS | Value of the MSS option header field in the TCP packet | int |
| TCPOptions | List of Options numbers included in the TCP packet header | string |
| TCPSACKBlocks | List of the SACK Blocks option header in the TCP packet | string |
| TCPSACKPermitted | Value of the SACK Permitted option header in the TCP packet | int |
| TCPSequenceNumber | Value of the Sequence Number header field in the TCP packet | int |
| TCPTimestampECR | Value of the Timestamp Echo Reply option header in the TCP packet | int |
| TCPTimestampValue | Value of the Timestamp option header in the TCP packet | int |
| TCPUrgentPointer | Value of the Urgent Pointer header field in the TCP packet | int |
| TCPWindowScale | Value of the Window Scale option header in the TCP packet | int |
| TCPWindowSize | Value of the Window Size header field in the TCP packet | int |
| UDPChecksum | Value of the Checksum header field in the UDP packet | int |
| UDPPayloadLength | Value of the Payload Length header field in the UDP packet | int |
| Verdict | The action that Cloudflare systems think should be taken on the packet. Possible values are pass | drop | string |