diff --git a/src/content/docs/cloudflare-one/insights/analytics/gateway.mdx b/src/content/docs/cloudflare-one/insights/analytics/gateway.mdx index cb03daaac8262b..783aa3f3e3e77b 100644 --- a/src/content/docs/cloudflare-one/insights/analytics/gateway.mdx +++ b/src/content/docs/cloudflare-one/insights/analytics/gateway.mdx @@ -1,16 +1,79 @@ --- pcx_content_type: reference -title: Gateway analytics +title: Gateway analytics (DNS, HTTP, network sessions) sidebar: order: 4 --- -To see the top Allowed and Blocked requests across all of your DNS locations, go to **Analytics** > **Gateway**. You can filter the data by selecting a specific location and/or time. +Gateway analytics are composed of three separate dashboards: -- **Requests** — This chart shows an overview of the number of requests made by end users within the time period you specify. It shows a breakdown of requests based on the decision Gateway took (either Allowed or Blocked). -- **Allowed requests** — This chart shows a breakdown of the five domains which received the highest number of Allowed requests. It also shows the five domains which received the lowest amount of Allowed requests. By selecting **View all** to the right of either section of the chart, you will see a list of highest 100 and lowest 100 domains ranked by number of Allowed requests. -- **Top blocked requests** — This chart shows a breakdown of the five domains which received the highest number of Blocked requests. It also shows the five domains which received the lowest number of Blocked requests. By selecting **View all** to the right of either section of the chart, you'll see a list of highest 100 and lowest 100 domains ranked by number of Blocked requests. -- **Requests by category** — The charts in this card show a breakdown of the **Top allowed categories** and the **Top blocked categories** based on the number of requests that Gateway classified as belonging to a content category. +1. HTTP request analytics. +2. DNS query analytics. +3. Network session analytics. + +To view Gateway analytics, in [Zero Trust](https://one.dash.cloudflare.com/), go to **Analytics** > **Dashboards** > select your desired dashboard. + +## HTTP request analytics + +Cloudflare [Gateway HTTP policies](/cloudflare-one/policies/gateway/http-policies/) allow you to intercept all HTTP and HTTPS requests and either block, allow, or override specific elements such as websites, IP addresses, and file types. HTTP policies operate on Layer 7 for all TCP (and [optionally UDP](/cloudflare-one/policies/gateway/initial-setup/http/#1-connect-to-gateway)) traffic sent over ports `80` and `443`. + +- [Actions](/cloudflare-one/policies/gateway/http-policies/#actions): Policies can use a variety of actions, including [Allow](/cloudflare-one/policies/gateway/http-policies/#allow), [Block](/cloudflare-one/policies/gateway/http-policies/#block), and [Redirect](/cloudflare-one/policies/gateway/http-policies/#redirect). More advanced actions include [Isolate](/cloudflare-one/policies/gateway/http-policies/#isolate) (to run a website in a remote browser), [Do Not Inspect](/cloudflare-one/policies/gateway/http-policies/#do-not-inspect) (to bypass SSL decryption), and [Do Not Scan](/cloudflare-one/policies/gateway/http-policies/#do-not-scan) (to bypass specific security features). The Do Not Inspect rules are always evaluated first to allow for critical exceptions. + +- Logical expressions: Policies are built with a wide range of [selectors](/cloudflare-one/policies/gateway/http-policies/#selectors) that provide granular control, such as [Host](/cloudflare-one/policies/gateway/http-policies/#host), [User Email](/cloudflare-one/policies/gateway/http-policies/#users), [Destination IP](/cloudflare-one/policies/gateway/http-policies/#destination-ip), and [File Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-file-types). Selectors allow for rules like `Block all downloads of .exe files for all users` or `Redirect traffic from this specific user to a different URL.` + +### Value of HTTP request traffic analytics + +### Provided analytics + +- HTTP Requests over Time + - Time series view of HTTP requests +- Top Actions +- Top Countries +- Top Blocked Users +- Top Bandwidth Consumers +- Top Devices +- Top Source IPs + +## DNS query analytics + +Cloudflare [Gateway DNS policies](/cloudflare-one/policies/gateway/dns-policies/) allow administrators to filter and secure their organization's DNS traffic. When a user makes a DNS request, it is evaluated against a set of rules defined by an action and a logical expression known as a selector. + +- [Actions](/cloudflare-one/policies/gateway/dns-policies/#actions): The policies can take actions such as [Allow](/cloudflare-one/policies/gateway/dns-policies/#allow), which permits a request; [Block](/cloudflare-one/policies/gateway/dns-policies/#block), which prevents it; or [Override](/cloudflare-one/policies/gateway/dns-policies/#override), which reroutes the request to a different address. + +- Logical expressions: Policies are highly customizable using [selectors](/cloudflare-one/policies/gateway/dns-policies/#selectors) (such as [Content Categories](/cloudflare-one/policies/gateway/dns-policies/#content-categories), [Security Categories](/cloudflare-one/policies/gateway/dns-policies/#security-categories), [Source IP](/cloudflare-one/policies/gateway/dns-policies/#source-ip), or [Resolved IP](/cloudflare-one/policies/gateway/dns-policies/#resolved-ip)) and [operators](/cloudflare-one/policies/gateway/dns-policies/#comparison-operators). Selectors and operators enable the creation of granular rules to control access to specific content or to block threats. Policies can be applied before or after DNS resolution is completed. + +### Value of DNS query analytics + +### Provided analytics + +- DNS Queries over Time + - Time series view of DNS queries +- Top Actions +- Top Countries +- Top Blocked Users +- Top Allowed Users +- Top Blocked Devices + +## Network session analytics + +Cloudflare [Gateway network policies](/cloudflare-one/policies/gateway/network-policies/) allow administrators to control network-level traffic leaving their endpoints. Gateway network policies are identity-based, meaning they can be applied to individual users or groups to control access to non-HTTP resources. + +- [Actions](/cloudflare-one/policies/gateway/network-policies/#actions): The primary actions for network policies are [Allow](/cloudflare-one/policies/gateway/network-policies/#allow) and [Block](/cloudflare-one/policies/gateway/network-policies/#block). The Allow action permits traffic to specific IPs or ports, while the Block action denies it. When traffic is blocked, an optional notification can be sent to the user via the WARP client, often with a custom message. + +- Logical Expressions: Policies are created using a combination of [selectors](/cloudflare-one/policies/gateway/network-policies/#selectors), [operators](/cloudflare-one/policies/gateway/network-policies/#comparison-operators), and [values](/cloudflare-one/policies/gateway/network-policies/#value). Selectors include criteria such as [Destination IP](/cloudflare-one/policies/gateway/network-policies/#destination-ip), [Destination Port](/cloudflare-one/policies/gateway/network-policies/#destination-port), [Detected Protocol](/cloudflare-one/policies/gateway/network-policies/#detected-protocol), and [Source IP](/cloudflare-one/policies/gateway/network-policies/#source-ip). This allows for granular control over network traffic. + +### Value of network session analytics + +### Provided analytics + +- Network Sessions over Time + - Time series view of Network Sessions +- Top Actions +- Top Countries +- Top Blocked Users +- Top Bandwidth Consumers +- Top Devices +- Top Source IPs ## GraphQL queries