Cloudflare Logpush gains two new datasets and AI security log fields!
Hi everyone, it's Shiichan! Today I found a nice little logging update, so let me walk you through it.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
Over on the Cloudflare Changelog, the Logpush datasets got a sizable update. Two brand-new datasets were added, and some existing datasets picked up new fields too. In short, the logs you can export from Cloudflare Logs just got a bit richer.
The story so far
Logpush lets you push the logs Cloudflare collects into your own storage or a SIEM, but the available "datasets" and the fields inside them are fixed. So to add new observability points, Cloudflare has to add datasets or fields like this. This time, several of them were expanded at once.
What changes
Here are the two new datasets:
- Email Security Post-Delivery Events: a dataset for tracking actions taken on email after delivery
- Magic Network Monitoring Flow Logs: a dataset for network flow logs
The highlight, though, is the AI security fields added to existing datasets. Both Firewall events and HTTP requests now carry AI-related signals, which makes it easier to spot signs of AI-targeted attacks or prompt injection right in your logs.
Dive Deep
Let me get a bit more concrete about what was added.
Firewall events gained these four fields:
AISecurityInjectionScoreAISecurityPIICategoriesAISecurityTokenCountAISecurityUnsafeTopicCategories
HTTP requests got those same four plus Subrequests, for five new fields in total.
The new datasets are detailed too: Email Security Post-Delivery Events includes email-action details like FinalDisposition, Recipient, and Subject, while Magic Network Monitoring Flow Logs carries flow information like SourceAddress, DestinationPort, and Packets.
For the complete field definitions of each dataset, check the Logpush datasets docs before you start pushing logs.
Wrap-up
- Cloudflare Logpush added two new datasets (Email Security Post-Delivery Events / Magic Network Monitoring Flow Logs)
- Firewall events and HTTP requests gained AI security fields, and HTTP requests also picked up
Subrequests - Full field definitions live in the Logpush datasets docs
This one lands well for security folks pushing logs into a SIEM to tighten their defenses, and for ops teams who want better observability over their network and email!
