JA EN
shiichan

Cloudflare Logs gets 2 new Logpush datasets and 9 new fields across existing ones!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hi, I'm Shii-chan! I found a logging update from Cloudflare today, so let me walk you through it!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, the set of datasets supported by Logpush, which lets you forward logs in bulk to your external analytics pipeline, just got expanded. Two brand-new datasets were added, and several existing datasets gained new fields.

The story so far

Until now, Logpush didn't have a dataset dedicated to tracking account abuse detection events end to end, nor one for following Magic WAN BGP tunnel activity. The existing Firewall events, Gateway HTTP, and HTTP requests datasets also lacked some AI security signals and certain WAF and TLS details.

What changes

Security teams can now trace signs of account takeover or credential stuffing in much finer detail through logs. Teams running Magic WAN can log BGP tunnel state changes as well. And anyone already consuming these existing logs gets new fields carrying AI-based security verdicts and WAF signature information.

Dive Deep

Here are the two new datasets:

  • Account Abuse Protection Events: a new dataset covering authentication, bot scoring, and client information. Key fields include:
    • AuthenticationIdentityProvider / AuthenticationMethod / AuthenticationStatus (authentication)
    • BotScore / JA4 (bot and fingerprint scoring)
    • ClientASN / ClientCity / ClientCountry / ClientIP / UserAgent (client info)
    • Email / FraudEmailRisk / UserID (account info)
    • EphemeralID / EventSource / EventType / Host / RayID / Timestamp (base event info)
  • Magic BGP Logs: a new dataset for tracking Magic WAN BGP tunnel activity, with 6 fields: Direction, EventData, EventKind, EventTimestamp, TunnelID, and TunnelName.

And here's what got added to existing datasets:

  • Firewall events: added AISecurityCustomTopicCategories, WAFRequestSignatureCategories, and WAFRequestSignatureRefs (3 fields)
  • Gateway HTTP: added ExperimentalFeatures and PackageInfo (2 fields)
  • HTTP requests: added AISecurityCustomTopicCategories, ClientTLSKeyExchangeGroup, WAFRequestSignatureCategories, and WAFRequestSignatureRefs (4 fields)

For the complete field definitions of each dataset, Cloudflare points you to its Logpush datasets documentation.

Wrap-up

  • Two new datasets, Account Abuse Protection Events (19 fields) and Magic BGP Logs (6 fields), joined Logpush
  • Firewall events, Gateway HTTP, and HTTP requests each gained AI security, WAF, and TLS-related fields
  • Check the Logpush datasets documentation for the complete field definitions

If you're already forwarding logs through Logpush, this is a low-key but worth-knowing update for your security and ops work!

Related posts