Security analytics

Security analytics shows information about all incoming HTTP requests or only about requests mitigated by Cloudflare.

Use Security analytics as your starting point to understand and analyze traffic patterns, and to create security rules based on the filters you applied.

Security analytics is available in Security > Analytics.

Traffic

The Traffic tab displays information about all incoming HTTP requests for your domain, including requests not handled by Cloudflare security products.

In this tab you can perform several tasks:

• View the traffic distribution for your domain.
• Understand which traffic is being mitigated by Cloudflare security products, and where non-mitigated traffic is being served from (Cloudflare global network or origin server ↗).
• Analyze suspicious traffic and create tailored custom security rules based on applied filters.
• Find an appropriate rate limit for incoming traffic.

For information on how to use the Traffic tab, refer to Security Analytics.

If you need to modify existing security-related rules you already configured, consider also using the Events tab. This tab displays information about requests affected by Cloudflare security products.

Suspicious activity

The suspicious activity gives you information about suspicious requests that were identified by the Cloudflare detections you have enabled. The supported detections include:

• Account takeover
• Leaked credential check (only for user and password leaked)
• Malicious uploads
• WAF attack score
• Firewall for AI

Each suspicious activity is classified with a severity score that can vary from critical to low. You can use the filter option to investigate further.

Note

The Traffic tab includes functionality available in the Security Analytics page in the previous dashboard navigation structure. However, some page elements will appear in a different order, or they may be unavailable in the Traffic tab, such as Insights or the score-based analyses sidebar.

Events

Use the Events tab to review mitigated requests and to tailor your security configurations.

The Events tab displays information about requests actioned or flagged by Cloudflare security products. Each incoming HTTP request might generate one or more security events. The tab only shows these events, not the HTTP requests themselves. To obtain information on all incoming HTTP requests, use the Traffic tab.

Users on a Free plan can view summarized events by date in sampled logs. Customers on paid plans have access to additional graphs and dashboards that summarize the most relevant information about the current behavior of Cloudflare's security features on your domain.

For more information on the Events tab, refer to Security Events.

Note

The Events tab corresponds to the Security Events page in the previous dashboard navigation structure.