[CF1] how to use DEX, analytics and logs together

Author: deadlypants1973

src/content/docs/cloudflare-one/insights/analytics/index.mdx

@@ -9,6 +9,6 @@ sidebar:
 
 import { DirectoryListing, Render } from "~/components";
 
-[Cloudflare One](https://one.dash.cloudflare.com/) provides a catalog of saved analytics views for reporting and investigation.
+[Cloudflare One](https://one.dash.cloudflare.com/) provides a catalog of saved analytics views for reporting and investigation. Analytics dashboards provide visualizations of your log data.
 
 <DirectoryListing />

src/content/docs/cloudflare-one/insights/index.mdx

@@ -3,12 +3,72 @@ pcx_content_type: navigation
 title: Insights
 sidebar:
   order: 4
-  group:
-    hideIndex: true
 ---
 
 import { DirectoryListing } from "~/components";
 
-Cloudflare One provides observability tools to monitor your environment. View traffic metrics for Access applications and Gateway policies in Dashboards, monitor endpoint and network performance with Digital Experience Monitoring (DEX), and analyze logs for security events.
+Cloudflare One offers observability tools to monitor and troubleshoot your environment:  
+- [Analytics Dashboards](#analytics-dashboards) for traffic trends and policy insights  
+- [Logs](#logs) for event-level investigation  
+- [Digital Experience Monitoring (DEX)](#digital-experience-monitoring-dex) for device, network, and application performance  
+
+## Example usage
+
+#### Issue
+A user reports they cannot reach an internal application behind [Cloudflare Access](/cloudflare-one/).
+
+#### Solution
+1. The admin checks **Access Event Analytics dashboard to see if others are experiencing similar issues.
+2. The admin then reviews **Logs** to examine the user's authentication attempts and blocked requests.
+3. Finally, the admin uses **DEX** to evaluate the user's device and network performance, identifying the root cause.
+
+## How to use these tools together
+
+### Onboarding
+
+  1. Start with [Logs](/cloudflare-one/insights/logs/) to validate initial configuration and confirm that authentication is successful.
+  2. Use [Analytics overview](/cloudflare-one/insights/analytics-overview/) to confirm expected patterns and policy activity.
+
+### Daily monitoring
+
+  1. Use [Analytics Dashboards] to understand trends and environment behavior.  
+  2. Use Logs as needed for event-level verification.
+
+### User-reported issues
+
+  1. Start with Analytics Dashboards to review if the issue impacts others.  
+  2. Check Logs for specific failing events.  
+  3. Use DEX to diagnose device- or network-level causes with DEX tests and device monitoring.
+
+## Analytics dashboards
+
+Analytics dashboards provide visualizations of your log data. Analytics dashboards show you policy-related activity by showing top metrics such as blocked and allowed users, the geographic and source IP origins of traffic, and trends in network session and application usage.
+
+Administrators typically start with Analytics because they offer:
+
+- A high-level view of activity across your products, like Access, or security use-cases, such as AI and shadow IT.  
+- Visibility into trends, provided through time-series graphs, to track the evolution of key metrics (such as DNS queries, network sessions, HTTP requests, and CASB posture/content findings) over time.
+
+## Logs
+
+Logs provide line-by-line visibility into the events occurring within your Cloudflare One deployment. If Analytics highlight a spike or an anomaly, logs help you trace and analyze what happened.
+
+Use Logs when you need to:
+
+- Investigate a specific event; for example, a user's failed authentication attempt when trying to log into a Cloudflare One application.
+- Validate identity or device details; for example, confirming which user made the request, how they authenticated, and whether their device met required posture conditions.
+- Confirm policy matches; for example, verifying which specific rule allowed, blocked, or challenged a user's request and why it was applied.
+
+## Digital Experience Monitoring (DEX)
+
+Digital Experience Monitoring (DEX) provides visibility into device, network, and application performance. While Analytics and Logs show what happened on the network, DEX measures and tests device and [network conditions](/cloudflare-one/insights/dex/tests/) to reveal the performance factors affecting a user's experience.
+
+If a user notifies that “the connection isn't working” or “performance is slow,” DEX allows you to:
+
+- Use [device monitoring] to check device health and endpoint connectivity.
+- Test network health and application responsiveness with [synthetic tests].
+- Identify whether problems originate from the device (such as [issues with the WARP client]()), the network, or Cloudflare.
+
+## Directory
 
 <DirectoryListing />