← Logs / logs / logpush / logpush-job / datasets / account
Firewall events
The descriptions below detail the fields available for firewall_events.
AISecurityCustomTopicCategories
Type: object
Customer-defined AI Security topic labels and their relevance scores. A score of 1 indicates the highest relevance, and 99 indicates the lowest relevance.
AISecurityInjectionScore
Type: int
The score indicating the likelihood of a prompt injection attack in the request, as determined by AI Security.
AISecurityPIICategories
Type: array[string]
List of PII categories detected in the request by AI Security.
AISecurityTokenCount
Type: int
The number of tokens in the request, as counted by AI Security.
AISecurityUnsafeTopicCategories
Type: array[string]
List of unsafe topic categories detected in the request by AI Security.
Action
Type: string
The code of the first-class action the Cloudflare Firewall took on this request.
Possible actions are unknown | allow | block | challenge | jschallenge | log | connectionclose | challengesolved | challengebypassed | jschallengesolved | jschallengebypassed | bypass | managedchallenge | managedchallengenoninteractivesolved | managedchallengeinteractivesolved | managedchallengebypassed | precursorinterstitialpageissued | precursorinterstitialpagebypassed | precursorinterstitialpagesolved.
ClientASN
Type: int
The ASN of the visitor.
ClientASNDescription
Type: string
The ASN of the visitor as a string.
ClientCountry
Type: string
Country from which the request originated.
ClientIP
Type: string
The IP address of the visitor (IPv4 or IPv6).
ClientIPClass
Type: string
The classification of the visitor's IP address, possible values are: unknown | badHost | searchEngine | allowlist | monitoringService | noRecord | scan | tor.
ClientRefererHost
Type: string
The referer host.
ClientRefererPath
Type: string
The referer path requested by the visitor.
ClientRefererQuery
Type: string
The referer query string requested by the visitor.
ClientRefererScheme
Type: string
The referer URL scheme requested by the visitor.
ClientRequestHost
Type: string
The HTTP hostname requested by the visitor.
ClientRequestMethod
Type: string
The HTTP method used by the visitor.
ClientRequestPath
Type: string
The path requested by the visitor.
ClientRequestProtocol
Type: string
The version of HTTP protocol requested by the visitor.
ClientRequestQuery
Type: string
The query string requested by the visitor.
ClientRequestScheme
Type: string
The URL scheme requested by the visitor.
ClientRequestUserAgent
Type: string
The user-agent string of the visitor.
ContentScanObjResults
Type: array[string]
List of content scan results.
ContentScanObjSizes
Type: array[int]
List of content object sizes.
ContentScanObjTypes
Type: array[string]
List of content types.
Datetime
Type: int or string
The date and time the event occurred at the edge. To specify the timestamp format, refer to Output types.
Description
Type: string
The description of the rule triggered by this request.
EdgeColoCode
Type: string
The airport code of the Cloudflare data center that served this request.
EdgeResponseStatus
Type: int
HTTP response status code returned to the browser.
FirewallForAIInjectionScore (deprecated)
Type: int
The score indicating the likelihood of a prompt injection attack in the request, as determined by Firewall for AI. Deprecated: Use AISecurityInjectionScore instead.
FirewallForAIPIICategories (deprecated)
Type: array[string]
List of PII categories detected in the request by Firewall for AI. Deprecated: Use AISecurityPIICategories instead.
FirewallForAITokenCount (deprecated)
Type: int
The number of tokens in the request, as counted by Firewall for AI. Deprecated: Use AISecurityTokenCount instead.
FirewallForAIUnsafeTopicCategories (deprecated)
Type: array[string]
List of unsafe topic categories detected in the request by Firewall for AI. Deprecated: Use AISecurityUnsafeTopicCategories instead.
FraudUserID
Type: string
A unique identifier generated by the Fraud Detection system for each user, generated during any action determined by the fraud event type.
Kind
Type: string
The kind of event, currently only possible values are: firewall.
LeakedCredentialCheckResult
Type: string
Result of the check for leaked credentials.
Possible results are: password_leaked | username_and_password_leaked | username_password_similar | username_leaked | clean.
MatchIndex
Type: int
Rules match index in the chain. The last matching rule will have MatchIndex 0. If another rule matched before the last one, it will have MatchIndex 1. The same applies to any other matching rules, which will have a MatchIndex value of 2, 3, and so on.
Metadata
Type: object
Additional product-specific information. Metadata is organized in key:value pairs. Key and Value formats can vary by Cloudflare security product and can change over time.
OriginResponseStatus
Type: int
HTTP origin response status code returned to the browser.
OriginatorRayID
Type: string
The RayID of the request that issued the challenge/jschallenge.
RayID
Type: string
The RayID of the request.
Ref
Type: string
The user-defined identifier for the rule triggered by this request. Use refs to label your rules individually alongside the Cloudflare-provided RuleID. You can set refs via the Rulesets API for some security products.
RuleID
Type: string
The Cloudflare security product-specific RuleID triggered by this request.
Source
Type: string
The Cloudflare security product triggered by this request.
Possible sources are unknown | asn | country | ip | iprange | securitylevel | zonelockdown | waf | firewallrules | uablock | ratelimit | bic | hot | l7ddos | validation | botfight | apishield | botmanagement | dlp | firewallmanaged | firewallcustom | apishieldschemavalidation | apishieldtokenvalidation | apishieldsequencemitigation.
WAFRequestSignatureCategories
Type: array[string]
List of attack signature categories matched for the request.
WAFRequestSignatureRefs
Type: array[string]
List of attack signature rule references (refs) matched for the request.
ZoneName
Type: string
The human-readable name of the zone (for example, 'cloudflare.com').