diff --git a/src/content/docs/cloudflare-one/insights/analytics/access.mdx b/src/content/docs/cloudflare-one/insights/analytics/access.mdx index 814d1442d767247..70e1783915426ab 100644 --- a/src/content/docs/cloudflare-one/insights/analytics/access.mdx +++ b/src/content/docs/cloudflare-one/insights/analytics/access.mdx @@ -5,16 +5,20 @@ sidebar: order: 3 --- +import { Render } from "~/components"; + Access event analytics allows you to review login attempts to the applications you protect behind [Access](/cloudflare-one/access-controls/policies/). Access event analytics are powered by [Access audit logs](/cloudflare-one/insights/logs/audit-logs/). To view Access event analytics: -1. Log into [Zero Trust](https://one.dash.cloudflare.com). -2. Go to **Analytics** > **Dashboards**. +1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Insights**. +2. Go to **Dashboards**. 3. Select **Access event analytics**. Access Event Analytics aggregates authentication activity based on your [Access policies](/cloudflare-one/access-controls/policies/policy-management/). + + ## Available insights The Access event analytics dashboard includes a chart of Access activity over time. You can view a chronological chart of access events. The Access event analytics dashboard shows when access requests occurred, helping you spot spikes in login attempts. diff --git a/src/content/docs/cloudflare-one/insights/analytics/ai-security.mdx b/src/content/docs/cloudflare-one/insights/analytics/ai-security.mdx new file mode 100644 index 000000000000000..c4454bf7a71d55b --- /dev/null +++ b/src/content/docs/cloudflare-one/insights/analytics/ai-security.mdx @@ -0,0 +1,62 @@ +--- +pcx_content_type: reference +title: AI security +--- + +The AI security report dashboard summarizes your organization's AI usage and potential security risks. + +To view the AI security report dashboard: + +1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Insights**. +2. Go to **Dashboards**. +3. Select **AI security report**. + +## Prerequisites + +To populate the AI security report dashboard, you must have: + +* [Cloudflare Gateway](/cloudflare-one/traffic-policies/) enabled to inspect outbound HTTP and DNS traffic. +* User traffic to SaaS AI applications (for example, ChatGPT or Gemini) sent through Cloudflare Gateway. +* MCP servers behind Cloudflare Access policies. + +## Available insights + +The AI security report dashboard includes the following panels and metrics: + +* [Top 5 visited AI applications by user count](#top-5-visited-ai-applications-by-user-count) +* [Statuses applied to AI applications by application count](#statuses-applied-to-ai-applications-by-application-count) +* [Data uploaded to Artificial Intelligence applications by status](#data-uploaded-to-artificial-intelligence-applications-by-status) +* [MCP servers behind Access over time](#mcp-servers-behind-access-over-time) +* [Access login events to MCP servers](#access-login-events-to-mcp-servers) + +### Top 5 visited AI applications by user count + +Displays the most accessed AI tools in your organization and the number of users visiting each application in a time-series graph. +Each bar represents user activity for a specific AI application (for example, ChatGPT or Gemini) over time. + +Use this chart to monitor adoption trends and detect new or unauthorized AI tools being accessed. + +### Statuses applied to AI applications by application count + +Reports the total number of AI applications identified and their review statuses. +Statuses include: + +* Unreviewed — Applications not yet evaluated by administrators. +* In Review — Applications currently under review for approval. +* Unapproved — Applications that are restricted or blocked. +* Approved — Applications explicitly permitted for organizational use. + +### Data uploaded to Artificial Intelligence applications by status + +Reports the amount of data transferred to AI tools, broken down by review status (Unreviewed, In Review, Unapproved, Approved). +Use this report to understand whether sensitive data is being sent to unapproved or unreviewed AI applications. + +### MCP servers behind Access over time + +Displays the number of Managed Control Plane (MCP) servers that are protected behind Access policies over time. +Use this panel to monitor the number of MCP servers protected behind Access policies. + +### Access login events to MCP servers + +Reports the number of login events to MCP servers protected behind Access policies. +Use this panel to monitor the number of login events to MCP servers protected behind Access policies. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/insights/analytics/application-access.mdx b/src/content/docs/cloudflare-one/insights/analytics/application-access.mdx new file mode 100644 index 000000000000000..4433b4abba53d5b --- /dev/null +++ b/src/content/docs/cloudflare-one/insights/analytics/application-access.mdx @@ -0,0 +1,79 @@ +--- +pcx_content_type: reference +title: Application access report +--- + +import { Render } from "~/components"; + +The Application Access Report provides a high-level summary of [Access](/cloudflare-one/access-controls/policies/) usage across your organization. This dashboard helps administrators monitor authentication patterns, identity provider usage, and Access configuration metrics. If Access is not configured in your account, the dashboard appears empty. + +To view the Application Access Report dashboard: + +1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Insights**. +2. Go to **Dashboards**. +3. Select **Application Access Report**. + + + +## Prerequisites + +To populate the Application Access Report dashboard, you must have: + +* At least one [Access application](/cloudflare-one/access-controls/applications/) configured in your account. +* Users authenticating to these applications through Cloudflare Access. + +## Available insights + +The Application Access Report dashboard includes the following panels and metrics: + +* [Summary of Access activity](#summary-of-access-activity) +* [Access events](#access-events) +* [Access decisions by event count](#access-decisions-by-event-count) +* [Access applications by event count](#access-applications-by-event-count) +* [Access events by type](#access-events-by-type) +* [Top counts of event details](#top-counts-of-event-details) +* [Access admin metrics](#access-admin-metrics) + +### Summary of Access activity + +The Summary of Access activity section shows a time series of Access login events over a selected period and a summary of login events. You can filter a time period in the upper right corner of the dashboard. + +### Access events + +Shows a time series of Access login events over a selected period. Each bar represents the number of login events in the x-axis time interval. +You can use this graph to review user authentication activity and detect unusual login spikes. + +### Access decisions by event count + +Displays the total number of Access decisions made, grouped by outcome (for example, **Granted** or **Denied**). + +### Access applications by event count + +Shows a breakdown of authentication events by application type (for example, **Self-hosted**, **SaaS**, **Private network**, **Infrastructure** or **MCP Portal**). +Use this view to determine which application types users most frequently access. + +### Access events by type + +Categorizes authentication events by method, such as **SSO** or **Login** (direct credential-based authentication). +This panel helps administrators understand how users are authenticating across applications and identity providers. + +### Top counts of event details + +Lists the most common Access event attributes, including: + +* Application name — Displays the top accessed applications. +* Identity provider — Shows which identity providers (IdPs) were most used. +* Users — Lists top users by number of login events. +* Countries — Displays top countries where users logged in. +* IP addresses — Lists the top source IPs associated with login events. + +These insights help administrators identify usage patterns and trends. + +### Access admin metrics + +Provides a summary of Access configurations made by admin in your organization, including: + +* Applications configured — Total number of Access-protected applications, broken down by type (for example, Self-hosted, SaaS, RDP, SSH, Private network, and Dash SSO.) +* Policies configured — Total number of Access policies, grouped by policy type (for example, Allow, Block, Bypass, or Service Auth.) + +This section helps administrators audit their Access setup and verify that expected resources and policies are in place. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/insights/analytics/data-analytics.mdx b/src/content/docs/cloudflare-one/insights/analytics/data-analytics.mdx index 16adce120297d49..9f57ad0b7320639 100644 --- a/src/content/docs/cloudflare-one/insights/analytics/data-analytics.mdx +++ b/src/content/docs/cloudflare-one/insights/analytics/data-analytics.mdx @@ -7,8 +7,8 @@ The Data security analytics dashboard reports security issues and sensitive data To view the Data security analytics dashboard: -1. Log into [Zero Trust](https://one.dash.cloudflare.com). -2. Go to **Analytics** > **Dashboards**. +1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Insights**. +2. Go to **Dashboards**. 3. Select **Data security analytics**. ## Prerequisites diff --git a/src/content/docs/cloudflare-one/insights/analytics/gateway.mdx b/src/content/docs/cloudflare-one/insights/analytics/gateway.mdx index 297973944cb66e9..20f6a845f5eb1fa 100644 --- a/src/content/docs/cloudflare-one/insights/analytics/gateway.mdx +++ b/src/content/docs/cloudflare-one/insights/analytics/gateway.mdx @@ -11,7 +11,11 @@ Gateway analytics include three separate dashboards: - DNS query analytics. - Network session analytics. -To review Gateway analytics, log in to [Zero Trust](https://one.dash.cloudflare.com/) and go to **Analytics** > **Dashboards** > select your desired dashboard. +To review Gateway analytics: + +1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Insights**. +2. Go to **Dashboards**. +3. Select your desired dashboard. ## HTTP request analytics diff --git a/src/content/docs/cloudflare-one/insights/analytics/shadow-it-discovery.mdx b/src/content/docs/cloudflare-one/insights/analytics/shadow-it-discovery.mdx index fc9f3e5318c9074..c6d7920f89b570d 100644 --- a/src/content/docs/cloudflare-one/insights/analytics/shadow-it-discovery.mdx +++ b/src/content/docs/cloudflare-one/insights/analytics/shadow-it-discovery.mdx @@ -9,7 +9,11 @@ import { Render } from "~/components"; Shadow IT SaaS analytics provides visibility into the SaaS applications your users are visiting. This information allows you to create identity and device-driven Zero Trust policies to secure your users and data. -To access Shadow IT SaaS analytics, in [Zero Trust](https://one.dash.cloudflare.com), go to **Analytics** > **Dashboards**, then select **Shadow IT: SaaS analytics**. +To access Shadow IT SaaS analytics: + +1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Insights**. +2. Go to **Dashboards**. +3. Select **Shadow IT: SaaS analytics**. ## Prerequisites diff --git a/src/content/partials/cloudflare-one/analytics/access-analytics-comparison.mdx b/src/content/partials/cloudflare-one/analytics/access-analytics-comparison.mdx new file mode 100644 index 000000000000000..a584a6e27d6accd --- /dev/null +++ b/src/content/partials/cloudflare-one/analytics/access-analytics-comparison.mdx @@ -0,0 +1,5 @@ +--- +{} +--- + +The [Application Access Report](/cloudflare-one/insights/analytics/application-access/) dashboard offers a summary of overall Access activity, while [Access event analytics](/cloudflare-one/insights/analytics/access/) dashboard provides a view of login events. You can export the Application Access Report to a PDF to share with stakeholders.