Skip to content

Commit 9597cda

Browse files
maxvpmaxvp
authored
[ZT] Log Explorer for Zero Trust datasets (#20373)
1 parent 79b5f03 commit 9597cda

File tree

4 files changed

+76
-66
lines changed

4 files changed

+76
-66
lines changed

‎src/content/docs/cloudflare-one/insights/logs/index.mdx‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ head:
88
content: Zero Trust logs
99
---
1010

11-
import { DirectoryListing } from "~/components";
11+
import { DirectoryListing, Badge, Render } from "~/components";
1212

1313
Review detailed logs for your Zero Trust organization.
1414

@@ -18,19 +18,25 @@ Review detailed logs for your Zero Trust organization.
1818

1919
Cloudflare Zero Trust logs are stored for a varying period of time based on the service used and plan type:
2020

21-
| | Free | Standard | Access | Gateway | Enterprise |
22-
| ----| ------ | ------ | ------ | ------ | -------- |
23-
| **Admin logs** | 18 months | 18 months | 18 months | 18 months | 18 months | 18 months |
24-
| **Access logs** | 24 hours | 30 days | 30 days | 24 hours | 180 days |
25-
| **DNS logs** | 24 hours | 30 days | 24 hours | 30 days | 180 days<sup><a href="#footnote-1">1</a></sup> |
26-
| **Network logs** | 24 hours | 30 days | 24 hours | 30 days | 30 days |
27-
| **HTTP logs** | 24 hours | 30 days | 24 hours | 30 days | 30 days |
28-
| **DEX logs** | 7 days | 7 days | 7 days | 7 days | 7 days |
29-
| **Device posture logs** | 30 days | 30 days | 30 days | 30 days | 30 days |
30-
31-
<a name="footnote-1"><sup>1</sup></a> Enterprise users on per query plans cannot store DNS logs via Cloudflare.
32-
You can still export logs via [Logpush](/cloudflare-one/insights/logs/logpush/).
33-
For more information, contact your account team.
21+
| | Free | Standard | Access | Gateway | Enterprise |
22+
| ----------------------- | --------- | --------- | --------- | --------- | ------------ |
23+
| **Admin logs** | 18 months | 18 months | 18 months | 18 months | 18 months |
24+
| **Access logs** | 24 hours | 30 days | 30 days | 24 hours | 180 days |
25+
| **DNS logs** | 24 hours | 30 days | 24 hours | 30 days | 180 days[^1] |
26+
| **Network logs** | 24 hours | 30 days | 24 hours | 30 days | 30 days |
27+
| **HTTP logs** | 24 hours | 30 days | 24 hours | 30 days | 30 days |
28+
| **DEX logs** | 7 days | 7 days | 7 days | 7 days | 7 days |
29+
| **Device posture logs** | 30 days | 30 days | 30 days | 30 days | 30 days |
30+
31+
[^1]: Enterprise users on per query plans cannot store DNS logs via Cloudflare. You can still export logs via [Logpush](/cloudflare-one/insights/logs/logpush/). For more information, contact your account team.
32+
33+
## Log Explorer <Badge text="Beta" variant="caution" size="small" />
34+
35+
Log Explorer users can store Zero Trust logs directly within Cloudflare in an [R2 bucket](/r2/) and access them with the dashboard or API. Log Explorer supports the following Zero Trust datasets:
36+
37+
<Render file="log-explorer-account-datasets" product="logs" />
38+
39+
For more information, refer to [Log Explorer](/logs/log-explorer/).
3440

3541
## Customer Metadata Boundary
3642

‎src/content/docs/cloudflare-one/insights/logs/logpush.mdx‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -35,19 +35,20 @@ You can configure multiple destinations and add additional fields to your logs b
3535

3636
## Zero Trust datasets
3737

38-
Refer to the Logpush documentation for a list of available fields.
39-
40-
| Dataset | Description |
41-
| ------------------------------------------------------------------------------- | -------------------------------------------------------------- |
42-
| [Gateway DNS](/logs/reference/log-fields/account/gateway_dns/) | DNS queries inspected by Cloudflare Gateway |
43-
| [Gateway HTTP](/logs/reference/log-fields/account/gateway_http/) | HTTP requests inspected by Cloudflare Gateway |
44-
| [Gateway Network](/logs/reference/log-fields/account/gateway_network/) | Network packets inspected by Cloudflare Gateway |
45-
| [Audit Logs](/logs/reference/log-fields/account/audit_logs/) | Authentication events through Cloudflare Access |
46-
| [Access Requests](/logs/reference/log-fields/account/access_requests/) | HTTP requests to sites protected by Cloudflare Access |
47-
| [CASB Findings](/logs/reference/log-fields/account/casb_findings/) | Security issues detected by Cloudflare CASB |
48-
| [Device Posture](/logs/reference/log-fields/account/device_posture_results/) | Device posture status from the WARP client |
49-
| [Session Logs](/logs/reference/log-fields/account/zero_trust_network_sessions/) | Network session logs for traffic proxied by Cloudflare Gateway |
50-
| [SSH Logs](/logs/reference/log-fields/account/ssh_logs/) | SSH command logs for [Access for Infrastructure targets](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) |
38+
Refer to [Logpush log fields](/logs/reference/log-fields/) for a list of all available fields.
39+
40+
| Dataset | Description |
41+
| -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
42+
| [Access Requests](/logs/reference/log-fields/account/access_requests/) | HTTP requests to sites protected by Cloudflare Access |
43+
| [Audit Logs](/logs/reference/log-fields/account/audit_logs/) | Authentication events through Cloudflare Access |
44+
| [CASB Findings](/logs/reference/log-fields/account/casb_findings/) | Security issues detected by Cloudflare CASB |
45+
| [Device Posture Results](/logs/reference/log-fields/account/device_posture_results/) | Device posture status from the WARP client |
46+
| [DLP Forensic Copies](/logs/reference/log-fields/account/dlp_forensic_copies/) | Entire HTTP requests or payloads of HTTP requests captured by [Cloudflare DLP](/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options/) |
47+
| [Gateway DNS](/logs/reference/log-fields/account/gateway_dns/) | DNS queries inspected by Cloudflare Gateway |
48+
| [Gateway HTTP](/logs/reference/log-fields/account/gateway_http/) | HTTP requests inspected by Cloudflare Gateway |
49+
| [Gateway Network](/logs/reference/log-fields/account/gateway_network/) | Network packets inspected by Cloudflare Gateway |
50+
| [SSH Logs](/logs/reference/log-fields/account/ssh_logs/) | SSH command logs for [Access for Infrastructure targets](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) |
51+
| [Zero Trust Network Session Logs](/logs/reference/log-fields/account/zero_trust_network_sessions/) | Network session logs for traffic proxied by Cloudflare Gateway |
5152

5253
## Parse DNS logs
5354

‎src/content/docs/logs/log-explorer.mdx‎

Lines changed: 31 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ sidebar:
77
text: Beta
88
---
99

10-
import { TabItem, Tabs } from "~/components";
10+
import { TabItem, Tabs, Render } from "~/components";
1111

1212
Log Explorer enables you to store and explore your Cloudflare logs directly within the Cloudflare Dashboard or API. Giving you visibility into your logs without the need to forward them to third parties. Logs are stored on Cloudflare's global network using the R2 object storage platform and can be queried via the Dashboard or SQL API.
1313

@@ -26,13 +26,7 @@ Log Explorer is available at the account and zone level. At the zone level, data
2626

2727
At the account level, the datasets available are:
2828

29-
- [Access requests](/logs/reference/log-fields/account/access_requests/) (`FROM access_requests`)
30-
- [CASB Findings](/logs/reference/log-fields/account/casb_findings/) (`FROM casb_findings`)
31-
- [Device posture results](/logs/reference/log-fields/account/device_posture_results/) (`FROM device_posture_results`)
32-
- [Gateway DNS](/logs/reference/log-fields/account/gateway_dns/) (`FROM gateway_dns`)
33-
- [Gateway HTTP](/logs/reference/log-fields/account/gateway_http/) (`FROM gateway_http`)
34-
- [Gateway Network](/logs/reference/log-fields/account/gateway_network/) (`FROM gateway_network`)
35-
- [Zero Trust Network Session Logs](/logs/reference/log-fields/account/zero_trust_network_sessions/) (`FROM zero_trust_network_sessions`)
29+
<Render file="log-explorer-account-datasets" product="logs" />
3630

3731
## Authentication
3832

@@ -54,8 +48,6 @@ Authentication with the API can be done via an authentication header or API toke
5448

5549
- `Authorization: Bearer <API_TOKEN>` To create an appropriately scoped API token, refer to [Create API token](/fundamentals/api/get-started/create-token/) documentation. Copy and paste the token into the authorization parameter for your API call.
5650

57-
58-
5951
## Enable Log Explorer
6052

6153
In order for Log Explorer to begin storing logs, you need to enable the desired datasets. You can do this via the dashboard or the API.
@@ -150,18 +142,18 @@ Which returns the following HTTP request details:
150142

151143
```json
152144
{
153-
"result": [
154-
{
155-
"clientrequestscheme": "https",
156-
"clientrequesthost": "example.com",
157-
"clientrequestmethod": "GET",
158-
"clientrequestuseragent": "curl/7.88.1",
159-
"edgeresponsestatus": 200
160-
}
161-
],
162-
"success": true,
163-
"errors": [],
164-
"messages": []
145+
"result": [
146+
{
147+
"clientrequestscheme": "https",
148+
"clientrequesthost": "example.com",
149+
"clientrequestmethod": "GET",
150+
"clientrequestuseragent": "curl/7.88.1",
151+
"edgeresponsestatus": 200
152+
}
153+
],
154+
"success": true,
155+
"errors": [],
156+
"messages": []
165157
}
166158
```
167159

@@ -177,23 +169,23 @@ Which returns the following request details:
177169

178170
```json
179171
{
180-
"result": [
181-
{
182-
"createdat": "2025-01-14T18:17:55Z",
183-
"appdomain": "example.com",
184-
"appuuid": "a66b4ab0-ccdf-4d60-a6d0-54a59a827d92",
185-
"action": "login",
186-
"allowed": true,
187-
"country": "us",
188-
"rayid": "90fbb07c0b316957",
189-
"email": "[email protected]",
190-
"ipaddress": "1.2.3.4",
191-
"useruid": "52859e81-711e-4de0-8b31-283336060e79"
192-
}
193-
],
194-
"success": true,
195-
"errors": [],
196-
"messages": []
172+
"result": [
173+
{
174+
"createdat": "2025-01-14T18:17:55Z",
175+
"appdomain": "example.com",
176+
"appuuid": "a66b4ab0-ccdf-4d60-a6d0-54a59a827d92",
177+
"action": "login",
178+
"allowed": true,
179+
"country": "us",
180+
"rayid": "90fbb07c0b316957",
181+
"email": "[email protected]",
182+
"ipaddress": "1.2.3.4",
183+
"useruid": "52859e81-711e-4de0-8b31-283336060e79"
184+
}
185+
],
186+
"success": true,
187+
"errors": [],
188+
"messages": []
197189
}
198190
```
199191

‎src/content/partials/logs/log-explorer-account-datasets.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
{}
3+
---
4+
5+
- [Access requests](/logs/reference/log-fields/account/access_requests/) (`FROM access_requests`)
6+
- [CASB Findings](/logs/reference/log-fields/account/casb_findings/) (`FROM casb_findings`)
7+
- [Device posture results](/logs/reference/log-fields/account/device_posture_results/) (`FROM device_posture_results`)
8+
- [Gateway DNS](/logs/reference/log-fields/account/gateway_dns/) (`FROM gateway_dns`)
9+
- [Gateway HTTP](/logs/reference/log-fields/account/gateway_http/) (`FROM gateway_http`)
10+
- [Gateway Network](/logs/reference/log-fields/account/gateway_network/) (`FROM gateway_network`)
11+
- [Zero Trust Network Session Logs](/logs/reference/log-fields/account/zero_trust_network_sessions/) (`FROM zero_trust_network_sessions`)

0 commit comments

Comments
 (0)