Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from

## Task 1 - Connect your Database to Looker

Looker connects to a database in order to query the data. In this tutorial, we use Google Big Query as an example. Learn [how to connect Google BigQuery to Looker](https://docs.looker.com/setup-and-management/database-config/google-bigquery#create_a_temporary_dataset_for_persistent_derived_tables).
Looker connects to a database in order to query the data. In this tutorial, we use Google BigQuery as an example. Learn [how to connect Google BigQuery to Looker](https://docs.looker.com/setup-and-management/database-config/google-bigquery#create_a_temporary_dataset_for_persistent_derived_tables).

Once you load Cloudflare logs into your database, [connect the database to Looker](https://docs.looker.com/setup-and-management/connecting-to-db).

Expand All @@ -53,7 +53,7 @@ To create your new LookML project:

6. For **Starting Point**, choose \*Clone Public Git Repository\*\*.\*\*\*

7. Enter the *cloudflare\_block* URL for the public Git repository `git://github.com/llooker/cloudflare_block.git`.
7. Enter the *cloudflare\_block* URL for the public Git repository `git://github.com/looker/cloudflare_block.git`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch updating the GitHub repository URL from 'llooker' to 'looker'. This ensures users are directed to the official Looker organization repository.


8. Click **Create Project**. Looker will pull all of the repository files into a new LookML project.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ For reference information on NAv2 nodes, refer to the [NAv2 node reference](/ana

:::note[Obtaining data for ingress traffic only]

All the NAv2 `*AnalyticsAdaptiveGroups` nodes include data for ingress and egress traffic. To obtain data about ingress traffic only, include `direction: "ingress"` in your [GraphQL query filter](/analytics/graphql-api/features/filtering/).
All the NAv2 `*AnalyticsAdaptiveGroups` nodes include data for ingress and egress traffic. To obtain data about ingress traffic only, include `direction: 'ingress'` in your [GraphQL query filter](/analytics/graphql-api/features/filtering/).
:::

## Schema comparison
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ The sample rate is 1/1,000 packets.

### `advancedDnsProtectionNetworkAnalyticsAdaptiveGroups`

This node is only available to Magic Transit customers. Provides metadata about DNS-based DDoS attacks mitigated by Cloudflare's [Advanced DNS Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) system.
This node is only available to Magic Transit customers. Provides metadata about DNS-based DDoS attacks mitigated by Cloudflare's [Advanced DNS Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) system.

Samples include information about the following DNS header fields:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ The following table lists direct mappings between NAv1 and NAv2 fields, when ava
</th>
<th>dosdNetworkAnalytics-AdaptiveGroups</th>
<th>dosdAttackAnalytics-Groups</th>
<th>flowtrackdNetworkAnalytics-AdaptiveGroups</th>
<th>flowtrackedNetworkAnalytics-AdaptiveGroups</th>
<th>magicFirewallNetworkAnalytics-AdaptiveGroups</th>
</tr>
</thead>
Expand Down Expand Up @@ -320,7 +320,7 @@ The following table lists direct mappings between NAv1 and NAv2 fields, when ava
</th>
<th>dosdNetworkAnalytics-AdaptiveGroups</th>
<th>dosdAttackAnalytics-Groups</th>
<th>flowtrackdNetworkAnalytics-AdaptiveGroups</th>
<code>flowtrackedNetworkAnalytics-AdaptiveGroups</code>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change not only modifies the name from 'flowtrackd' to 'flowtracked' (which may be incorrect), but also changes the HTML structure from a table header to a element. This will break the table formatting in the documentation.

<th>magicFirewallNetworkAnalytics-AdaptiveGroups</th>
</tr>
<tr>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ In this example, we are going to use the GraphQL Analytics API to retrieve logs

The following API call will request logs for a single Access login event and output the requested fields. The authentication request is identified by its **Ray ID**, which you can obtain from the `403` Forbidden page shown to the user.

You will need to insert your `<CLOUDFLARE_ACCOUNT_TAG>`, your API credentials in `<API_TOKEN>`[^1], and substitute your own values for the following variables:
You will need to insert your `<Cloudflare_ACCOUNT_TAG>`, your API credentials in `<API_TOKEN>`[^1], and substitute your own values for the following variables:

* `rayID`: A unique identifier assigned to the authentication request.
* `datetimeStart`: The earliest event time to query (no earlier than September 16, 2022).
Expand Down Expand Up @@ -103,4 +103,4 @@ Rather than filter by `cfRayId`, you may also [filter](/analytics/graphql-api/fe

You can compare the query results to your Access policies to understand why a user was blocked. For example, if your application requires a valid mTLS certificate, Access blocked the request shown above because `mtlsStatus`, `mtlsCommonName`, and `mtlsCertSerialId` are empty.

[^1]: Refer to [Configure an Analytics API token](/analytics/graphql-api/getting-started/authentication/api-token-auth/) for more information on configuration and permissions.
[^1]: Refer to [Configure an Analytics API token](/analytics/graphql-api/getting-started/authentication/api-token-auth/) for more information on configuration and permissions.
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ title: Querying Firewall Events with GraphQL

In this example, we are going to use the GraphQL Analytics API to query for Firewall Events over a specified time period.

The following API call will request Firewall Events over a one hour period, and output the requested fields. Be sure to replace `<CLOUDFLARE_ZONE_TAG>`, `<EMAIL>`, and `<API_TOKEN>`[^1] with your zone tag and API credentials, and adjust the `datetime_geg` and `datetime_leq` values to your liking.
The following API call will request Firewall Events over a one hour period, and output the requested fields. Be sure to replace `<Cloudflare_ZONE_TAG>`, `<EMAIL>`, and `<API_TOKEN>`[^1] with your zone tag and API credentials, and adjust the `datetime_geq` and `datetime_leq` values to your liking.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch fixing the parameter name from datetime_geg to datetime_geq. This correction is important as the incorrect parameter name would cause API queries to fail.


## API Call

Expand Down Expand Up @@ -183,4 +183,4 @@ https://api.cloudflare.com/client/v4/graphql \
#=> }
```

[^1]: Refer to [Configure an Analytics API token](/analytics/graphql-api/getting-started/authentication/api-token-auth/) for more information on configuration and permissions.
[^1]: Refer to [Configure an Analytics API token](/analytics/graphql-api/getting-started/authentication/api-token-auth/) for more information on configuration and permissions.
Loading