From c015d202bddb90efb335df15f281469eb43e0f96 Mon Sep 17 00:00:00 2001 From: mvm Date: Fri, 11 Sep 2026 18:12:13 -0500 Subject: [PATCH 1/3] chore: fetch Logpush dataset pages from middlecache --- .gitignore | 4 + AGENTS.md | 3 +- bin/fetch-logpush-datasets.ts | 170 ++++ package.json | 6 +- pnpm-lock.yaml | 92 ++- .../datasets/account/access_requests.md | 100 --- .../account_abuse_protection_events.md | 124 --- .../datasets/account/audit_logs.md | 100 --- .../datasets/account/audit_logs_v2.md | 148 ---- .../datasets/account/biso_user_actions.md | 64 -- .../datasets/account/casb_findings.md | 82 -- .../account/device_posture_results.md | 118 --- .../datasets/account/dex_application_tests.md | 466 ----------- .../account/dex_device_state_events.md | 370 --------- .../datasets/account/dlp_forensic_copies.md | 58 -- .../datasets/account/dns_firewall_logs.md | 124 --- .../datasets/account/email_security_alerts.md | 202 ----- .../email_security_post_delivery_events.md | 136 ---- .../datasets/account/firewall_events.md | 292 ------- .../datasets/account/gateway_dns.md | 502 ------------ .../datasets/account/gateway_http.md | 382 --------- .../datasets/account/gateway_network.md | 214 ----- .../datasets/account/ipsec_logs.md | 52 -- .../datasets/account/magic_bgp_logs.md | 46 -- .../datasets/account/magic_ids_detections.md | 82 -- .../datasets/account/mcp_portal_logs.md | 124 --- .../datasets/account/mnm_flow_logs.md | 154 ---- .../account/network_analytics_logs.md | 514 ------------ .../datasets/account/sinkhole_http_logs.md | 112 --- .../logpush-job/datasets/account/ssh_logs.md | 118 --- .../datasets/account/turnstile_events.md | 88 --- .../datasets/account/warp_config_changes.md | 82 -- .../datasets/account/warp_toggle_changes.md | 64 -- .../datasets/account/websocket_analytics.md | 112 --- .../datasets/account/workers_trace_events.md | 88 --- .../account/zero_trust_network_sessions.md | 270 ------- .../zone/account_abuse_protection_events.md | 124 --- .../logpush-job/datasets/zone/dns_logs.md | 64 -- .../datasets/zone/firewall_events.md | 292 ------- .../datasets/zone/http_requests.md | 748 ------------------ .../logpush-job/datasets/zone/nel_reports.md | 52 -- .../datasets/zone/page_shield_events.md | 70 -- .../datasets/zone/spectrum_events.md | 196 ----- .../datasets/zone/websocket_analytics.md | 112 --- .../logpush-job/datasets/zone/zaraz_events.md | 52 -- 45 files changed, 242 insertions(+), 7131 deletions(-) create mode 100644 bin/fetch-logpush-datasets.ts delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/access_requests.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/account_abuse_protection_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/audit_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/audit_logs_v2.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/biso_user_actions.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/casb_findings.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/device_posture_results.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/dex_application_tests.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/dex_device_state_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/dlp_forensic_copies.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/dns_firewall_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/email_security_alerts.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/email_security_post_delivery_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/firewall_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_dns.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_http.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_network.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/ipsec_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/magic_bgp_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/magic_ids_detections.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/mcp_portal_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/mnm_flow_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/network_analytics_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/sinkhole_http_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/ssh_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/turnstile_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/warp_config_changes.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/warp_toggle_changes.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/websocket_analytics.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/workers_trace_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/account_abuse_protection_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/dns_logs.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/firewall_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/nel_reports.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/page_shield_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/spectrum_events.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/websocket_analytics.md delete mode 100644 src/content/docs/logs/logpush/logpush-job/datasets/zone/zaraz_events.md diff --git a/.gitignore b/.gitignore index 0644d6a479d..774a86df5eb 100644 --- a/.gitignore +++ b/.gitignore @@ -14,6 +14,10 @@ skills/ !.flue/.agents/ !.flue/.agents/** +# Logpush dataset pages are fetched from middlecache via bin/fetch-logpush-datasets.ts +src/content/docs/logs/logpush/logpush-job/datasets/zone/*.md +src/content/docs/logs/logpush/logpush-job/datasets/account/*.md + # dependencies node_modules/ diff --git a/AGENTS.md b/AGENTS.md index 78dfea438c2..5d4edf5fa06 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -37,7 +37,8 @@ cloudflare-docs/ ├── public/ # Static files served as-is (images, redirects, robots.txt) ├── worker/ # Cloudflare Worker for serving the site ├── bin/ # Build scripts and CI helpers -│ └── fetch-skills.ts # Downloads skills.tar.gz from middlecache, extracts to skills/ +│ ├── fetch-skills.ts # Downloads skills.tar.gz from middlecache, extracts to skills/ +│ └── fetch-logpush-datasets.ts # Downloads generated Logpush dataset pages from middlecache ├── skills/ # Agent Skills served at /.well-known/skills/ — GENERATED, do not edit │ # Fetched from https://middlecache.ced.cloudflare.com/v1/cloudflare-skills/skills.tar.gz │ # by bin/fetch-skills.ts, which runs automatically via prebuild/predev hooks. diff --git a/bin/fetch-logpush-datasets.ts b/bin/fetch-logpush-datasets.ts new file mode 100644 index 00000000000..3843a4fb72c --- /dev/null +++ b/bin/fetch-logpush-datasets.ts @@ -0,0 +1,170 @@ +#!/usr/bin/env tsx + +import fs from "fs"; +import { join } from "path"; + +import YAML from "yaml"; + +import { + downloadToDotTempIfNotPresent, + extractTarGz, +} from "../src/util/custom-loaders"; + +const MIDDLECACHE_BASE_URL = `${( + process.env.MIDDLECACHE_BASE_URL ?? "https://middlecache.ced.cloudflare.com" +).replace(/\/+$/, "")}/`; +const ARCHIVE_MIDDLECACHE_PATH = "v1/logpush-datasets/datasets.tar.gz"; +const ARCHIVE_DOT_TMP_PATH = `middlecache/${ARCHIVE_MIDDLECACHE_PATH}`; +const DATASETS_DIR = "./src/content/docs/logs/logpush/logpush-job/datasets"; +const EXTRACTED_DIR = join(".tmp", "logpush-datasets-extracted"); + +// --soft: warn and continue on failure instead of exiting non-zero. +// Used by the predev hook so a network failure doesn't block local development. +// --force: re-fetch even if the generated dataset pages already exist. +const soft = process.argv.includes("--soft"); +const force = process.argv.includes("--force"); + +const fail = (message: string): never => { + if (soft) { + const hasPages = fs.existsSync(DATASETS_DIR) + ? getManagedScopes().some((scope) => getScopePages(scope).length > 0) + : false; + console.warn( + hasPages + ? `Warning: ${message} — continuing with existing Logpush dataset pages` + : `Warning: ${message} — Logpush dataset pages are missing, /logs/logpush/logpush-job/datasets/ will not work`, + ); + process.exit(0); + } + console.error(`Error: ${message}`); + process.exit(1); +}; + +// The scope dirs are hand-maintained (they carry index.mdx + sidebar wiring); +// generated .md pages are only synced into scopes that already exist. +const getManagedScopes = () => + fs + .readdirSync(DATASETS_DIR, { withFileTypes: true }) + .filter((entry) => entry.isDirectory()) + .map((entry) => entry.name) + .filter((scope) => fs.existsSync(join(DATASETS_DIR, scope, "index.mdx"))); + +const getScopePages = (scope: string) => { + const scopeDir = join(DATASETS_DIR, scope); + return fs.existsSync(scopeDir) + ? fs + .readdirSync(scopeDir) + .filter((file) => file.endsWith(".md")) + .sort() + : []; +}; + +const managedScopes = getManagedScopes(); +const hasGeneratedPages = + fs.existsSync(DATASETS_DIR) && + managedScopes.length > 0 && + managedScopes.every((scope) => getScopePages(scope).length > 0); + +if (hasGeneratedPages && !force) { + console.log( + "Logpush dataset pages already present, skipping fetch. (run `pnpm tsx bin/fetch-logpush-datasets.ts --force` to re-fetch)", + ); + process.exit(0); +} + +console.log("Fetching Logpush dataset pages from middlecache"); + +try { + await downloadToDotTempIfNotPresent( + `${MIDDLECACHE_BASE_URL}${ARCHIVE_MIDDLECACHE_PATH}`, + ARCHIVE_DOT_TMP_PATH, + ); +} catch (err) { + fail(`fetch failed: ${err}`); +} + +const archivePath = join(".tmp", ...ARCHIVE_DOT_TMP_PATH.split("/")); + +// Remove any stale extracted content so we never sync pages from an old run. +fs.rmSync(EXTRACTED_DIR, { recursive: true, force: true }); + +try { + await extractTarGz(archivePath, EXTRACTED_DIR); +} catch (err) { + fail(`tar extraction failed: ${(err as Error).message}`); +} + +const archiveScopes = fs + .readdirSync(EXTRACTED_DIR, { withFileTypes: true }) + .filter((entry) => entry.isDirectory()) + .map((entry) => entry.name); + +// Warn about archive scopes that have no hand-written nav wiring yet; they are +// not synced until an index.mdx + sidebar entry are added for them. +for (const scope of archiveScopes) { + if (!managedScopes.includes(scope)) { + console.warn( + `Warning: skipping Logpush dataset scope not seeded in the docs: ${scope}`, + ); + } +} + +const pagesToCopy = new Map(); +for (const scope of managedScopes) { + const sourceDir = join(EXTRACTED_DIR, scope); + if (!fs.existsSync(sourceDir)) { + fail( + `Logpush dataset archive is missing scope: ${scope}. If intentional, remove that scope's generated pages in the same change`, + ); + } + pagesToCopy.set( + scope, + fs + .readdirSync(sourceDir) + .filter((file) => file.endsWith(".md")) + .sort(), + ); +} + +// Validate frontmatter before touching the checked-in tree. +for (const [scope, pages] of pagesToCopy) { + for (const page of pages) { + const content = fs.readFileSync(join(EXTRACTED_DIR, scope, page), "utf8"); + const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---(?:$|\r?\n)/.exec( + content, + )?.[1]; + const metadata = frontmatter + ? (YAML.parse(frontmatter) as unknown) + : undefined; + if ( + !metadata || + typeof metadata !== "object" || + !("title" in metadata) || + typeof metadata.title !== "string" || + metadata.title.trim() === "" + ) { + fail(`Logpush dataset page has invalid frontmatter: ${scope}/${page}`); + } + } +} + +let written = 0; +let removed = 0; + +for (const [scope, pages] of pagesToCopy) { + const scopeDir = join(DATASETS_DIR, scope); + for (const page of getScopePages(scope)) { + if (!pages.includes(page)) { + fs.rmSync(join(scopeDir, page)); + removed++; + } + } + for (const page of pages) { + fs.copyFileSync(join(EXTRACTED_DIR, scope, page), join(scopeDir, page)); + written++; + } +} + +console.log( + `Logpush dataset pages ready (${written} written, ${removed} removed)`, +); diff --git a/package.json b/package.json index 775feaa4084..28377658b1d 100644 --- a/package.json +++ b/package.json @@ -12,7 +12,7 @@ "check": "pnpm run check:astro && pnpm run check:worker", "check:astro": "astro check --minimumFailingSeverity=hint", "check:worker": "tsc --noEmit -p ./worker/tsconfig.json", - "predev": "tsx bin/fetch-skills.ts --soft && tsx bin/fetch-openapi.ts --soft", + "predev": "tsx bin/fetch-skills.ts --soft && tsx bin/fetch-openapi.ts --soft && tsx bin/fetch-logpush-datasets.ts --soft", "dev": "astro dev", "format": "pnpm run format:core:fix && pnpm run format:data:fix && pnpm run format:content:fix", "format:check": "pnpm run format:core:check && pnpm run format:data:check && pnpm run format:content:check", @@ -40,7 +40,8 @@ "lint": "eslint", "prepare": "husky", "prebuild:incremental": "pnpm run fetch:assets", - "fetch:assets": "tsx bin/fetch-skills.ts && tsx bin/fetch-openapi.ts" + "fetch:assets": "tsx bin/fetch-skills.ts && tsx bin/fetch-openapi.ts && tsx bin/fetch-logpush-datasets.ts", + "fetch:logpush": "tsx bin/fetch-logpush-datasets.ts --force" }, "devDependencies": { "@actions/core": "3.0.1", @@ -145,6 +146,7 @@ "vite": "^8.3.0", "vitest": "4.1.11", "wrangler": "4.131.0", + "yaml": "2.9.0", "zod": "4.6.1" }, "lint-staged": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index be7b06bc407..a69f5aea3cd 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -317,6 +317,9 @@ importers: wrangler: specifier: 4.131.0 version: 4.131.0(@cloudflare/workers-types@5.20260910.1)(@types/node@26.5.1) + yaml: + specifier: 2.9.0 + version: 2.9.0 zod: specifier: 4.6.1 version: 4.6.1 @@ -2508,15 +2511,30 @@ packages: '@volar/language-server@2.4.28': resolution: {integrity: sha512-NqcLnE5gERKuS4PUFwlhMxf6vqYo7hXtbMFbViXcbVkbZ905AIVWhnSo0ZNBC2V127H1/2zP7RvVOVnyITFfBw==} + peerDependencies: + typescript: '*' + peerDependenciesMeta: + typescript: + optional: true '@volar/language-service@2.4.28': resolution: {integrity: sha512-Rh/wYCZJrI5vCwMk9xyw/Z+MsWxlJY1rmMZPsxUoJKfzIRjS/NF1NmnuEcrMbEVGja00aVpCsInJfixQTMdvLw==} + peerDependencies: + typescript: '*' + peerDependenciesMeta: + typescript: + optional: true '@volar/source-map@2.4.28': resolution: {integrity: sha512-yX2BDBqJkRXfKw8my8VarTyjv48QwxdJtvRgUpNE5erCsgEUdI2DsLbpa+rOQVAJYshY99szEcRDmyHbF10ggQ==} '@volar/typescript@2.4.28': resolution: {integrity: sha512-Ja6yvWrbis2QtN4ClAKreeUZPVYMARDYZl9LMEv1iQ1QdepB6wn0jTRxA9MftYmYa4DQ4k/DaSZpFPUfxl8giw==} + peerDependencies: + typescript: '*' + peerDependenciesMeta: + typescript: + optional: true '@vscode/emmet-helper@2.11.0': resolution: {integrity: sha512-QLxjQR3imPZPQltfbWRnHU6JecWTF1QSWhx3GAKQpslx7y3Dp6sIIXhKjiUJ/BR9FX8PVthjr9PD6pNwOJfAzw==} @@ -5773,17 +5791,23 @@ packages: resolution: {integrity: sha512-9K2k72s4n7rV9s4bX0MyjbX9iBribvKZbBJKuEmTCZfeWJXs6Yh7bGpY4eoc7UufAjvpheBqwyZCOIPBvxCv0A==} peerDependencies: '@volar/language-service': ~2.4.0 + typescript: '*' peerDependenciesMeta: '@volar/language-service': optional: true + typescript: + optional: true volar-service-typescript@0.0.71: resolution: {integrity: sha512-yTtM/BVT6hoyEYnDtaCyAtNhdNeS/mhTTABlBOdw3NNiRBUin3IznFJpgfjer4c6RYopiPjjQjc9VFhxVl1mLw==} peerDependencies: '@volar/language-service': ~2.4.0 + typescript: '*' peerDependenciesMeta: '@volar/language-service': optional: true + typescript: + optional: true volar-service-yaml@0.0.71: resolution: {integrity: sha512-qYGWGuVpUTnZGu5P/CR4KLK4aIR8RrcVnmfZ2eRcj9q/I8VZCoC5yy9FtEvfNvnDp4MU17yhdJcvpQPIqhJS2Q==} @@ -6182,17 +6206,17 @@ snapshots: '@jridgewell/sourcemap-codec': 1.5.5 '@volar/kit': 2.4.28(typescript@5.9.3) '@volar/language-core': 2.4.28 - '@volar/language-server': 2.4.28 - '@volar/language-service': 2.4.28 + '@volar/language-server': 2.4.28(typescript@5.9.3) + '@volar/language-service': 2.4.28(typescript@5.9.3) muggle-string: 0.4.1 tinyglobby: 0.2.17 - volar-service-css: 0.0.71(@volar/language-service@2.4.28) - volar-service-emmet: 0.0.71(@volar/language-service@2.4.28) - volar-service-html: 0.0.71(@volar/language-service@2.4.28) - volar-service-prettier: 0.0.71(@volar/language-service@2.4.28)(prettier@3.9.6) - volar-service-typescript: 0.0.71(@volar/language-service@2.4.28) - volar-service-typescript-twoslash-queries: 0.0.71(@volar/language-service@2.4.28) - volar-service-yaml: 0.0.71(@volar/language-service@2.4.28) + volar-service-css: 0.0.71(@volar/language-service@2.4.28(typescript@5.9.3)) + volar-service-emmet: 0.0.71(@volar/language-service@2.4.28(typescript@5.9.3)) + volar-service-html: 0.0.71(@volar/language-service@2.4.28(typescript@5.9.3)) + volar-service-prettier: 0.0.71(@volar/language-service@2.4.28(typescript@5.9.3))(prettier@3.9.6) + volar-service-typescript: 0.0.71(@volar/language-service@2.4.28(typescript@5.9.3))(typescript@5.9.3) + volar-service-typescript-twoslash-queries: 0.0.71(@volar/language-service@2.4.28(typescript@5.9.3))(typescript@5.9.3) + volar-service-yaml: 0.0.71(@volar/language-service@2.4.28(typescript@5.9.3)) vscode-html-languageservice: 5.6.2 vscode-uri: 3.1.0 optionalDependencies: @@ -8196,8 +8220,8 @@ snapshots: '@volar/kit@2.4.28(typescript@5.9.3)': dependencies: - '@volar/language-service': 2.4.28 - '@volar/typescript': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) + '@volar/typescript': 2.4.28(typescript@5.9.3) typesafe-path: 0.2.2 typescript: 5.9.3 vscode-languageserver-textdocument: 1.0.12 @@ -8207,32 +8231,38 @@ snapshots: dependencies: '@volar/source-map': 2.4.28 - '@volar/language-server@2.4.28': + '@volar/language-server@2.4.28(typescript@5.9.3)': dependencies: '@volar/language-core': 2.4.28 - '@volar/language-service': 2.4.28 - '@volar/typescript': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) + '@volar/typescript': 2.4.28(typescript@5.9.3) path-browserify: 1.0.1 request-light: 0.7.0 vscode-languageserver: 9.0.1 vscode-languageserver-protocol: 3.18.2 vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.1.0 + optionalDependencies: + typescript: 5.9.3 - '@volar/language-service@2.4.28': + '@volar/language-service@2.4.28(typescript@5.9.3)': dependencies: '@volar/language-core': 2.4.28 vscode-languageserver-protocol: 3.18.2 vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.1.0 + optionalDependencies: + typescript: 5.9.3 '@volar/source-map@2.4.28': {} - '@volar/typescript@2.4.28': + '@volar/typescript@2.4.28(typescript@5.9.3)': dependencies: '@volar/language-core': 2.4.28 path-browserify: 1.0.1 vscode-uri: 3.1.0 + optionalDependencies: + typescript: 5.9.3 '@vscode/emmet-helper@2.11.0': dependencies: @@ -12176,45 +12206,46 @@ snapshots: transitivePeerDependencies: - msw - volar-service-css@0.0.71(@volar/language-service@2.4.28): + volar-service-css@0.0.71(@volar/language-service@2.4.28(typescript@5.9.3)): dependencies: vscode-css-languageservice: 6.3.10 vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) - volar-service-emmet@0.0.71(@volar/language-service@2.4.28): + volar-service-emmet@0.0.71(@volar/language-service@2.4.28(typescript@5.9.3)): dependencies: '@emmetio/css-parser': 0.4.1 '@emmetio/html-matcher': 1.3.0 '@vscode/emmet-helper': 2.11.0 vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) - volar-service-html@0.0.71(@volar/language-service@2.4.28): + volar-service-html@0.0.71(@volar/language-service@2.4.28(typescript@5.9.3)): dependencies: vscode-html-languageservice: 5.6.2 vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) - volar-service-prettier@0.0.71(@volar/language-service@2.4.28)(prettier@3.9.6): + volar-service-prettier@0.0.71(@volar/language-service@2.4.28(typescript@5.9.3))(prettier@3.9.6): dependencies: vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) prettier: 3.9.6 - volar-service-typescript-twoslash-queries@0.0.71(@volar/language-service@2.4.28): + volar-service-typescript-twoslash-queries@0.0.71(@volar/language-service@2.4.28(typescript@5.9.3))(typescript@5.9.3): dependencies: vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) + typescript: 5.9.3 - volar-service-typescript@0.0.71(@volar/language-service@2.4.28): + volar-service-typescript@0.0.71(@volar/language-service@2.4.28(typescript@5.9.3))(typescript@5.9.3): dependencies: path-browserify: 1.0.1 semver: 7.8.5 @@ -12223,14 +12254,15 @@ snapshots: vscode-nls: 5.2.0 vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) + typescript: 5.9.3 - volar-service-yaml@0.0.71(@volar/language-service@2.4.28): + volar-service-yaml@0.0.71(@volar/language-service@2.4.28(typescript@5.9.3)): dependencies: vscode-uri: 3.1.0 yaml-language-server: 1.23.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@5.9.3) vscode-css-languageservice@6.3.10: dependencies: diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/access_requests.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/access_requests.md deleted file mode 100644 index 58ba033a4d9..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/access_requests.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Access requests -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `access_requests`. - -## Action - -Type: `string` - -What type of record is this. login \| logout. - -## Allowed - -Type: `bool` - -If request was allowed or denied. - -## AppDomain - -Type: `string` - -The domain of the Application that Access is protecting. - -## AppUUID - -Type: `string` - -Access Application UUID. - -## Connection - -Type: `string` - -Identity provider used for the login. - -## Country - -Type: `string` - -Request's country of origin. - -## CreatedAt - -Type: `int or string` - -The date and time the corresponding access request was made (for example, '2021-07-27T00:01:07Z'). - -## Email - -Type: `string` - -Email of the user who logged in. - -## IPAddress - -Type: `string` - -The IP address of the client. - -## PurposeJustificationPrompt - -Type: `string` - -Message prompted to the client when accessing the application. - -## PurposeJustificationResponse - -Type: `string` - -Justification given by the client when accessing the application. - -## RayID - -Type: `string` - -Identifier of the request. - -## TemporaryAccessApprovers - -Type: `array[string]` - -List of approvers for this access request. - -## TemporaryAccessDuration - -Type: `int` - -Approved duration for this access request. - -## UserUID - -Type: `string` - -The uid of the user who logged in. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/account_abuse_protection_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/account_abuse_protection_events.md deleted file mode 100644 index 4bfb240b946..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/account_abuse_protection_events.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Account Abuse Protection Events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `account_abuse_protection_events`. - -## AuthenticationIdentityProvider - -Type: `string` - -The identity provider used for login authentication. Only populated for login events.
Possible values are unknown \| other \| selfHosted \| amazon \| apple \| discord \| facebook \| github \| linkedin \| microsoft. - -## AuthenticationMethod - -Type: `string` - -The authentication method used for login. Only populated for login events.
Possible values are unknown \| password \| sso \| magicLink \| biometric \| passkey. - -## AuthenticationStatus - -Type: `string` - -The outcome of a login attempt. Only populated for login events.
Possible values are unknown \| other \| success \| failureOther \| failureUserNotFound \| failureIncorrectPassword \| failureAccountLocked \| pendingMfa. - -## BotScore - -Type: `int` - -Cloudflare Bot Management score. Values from 1 (likely bot) to 99 (likely human). - -## ClientASN - -Type: `int` - -Client AS number. - -## ClientCity - -Type: `string` - -Approximate city of the client. - -## ClientCountry - -Type: `string` - -2-letter ISO-3166 country code of the client IP address. - -## ClientIP - -Type: `string` - -IP address of the client. - -## Email - -Type: `string` - -The email address associated with the event. - -## EphemeralID - -Type: `string` - -The Turnstile ephemeral device identifier, hex-encoded. - -## EventSource - -Type: `string` - -The source of the Account Abuse Protection event.
Possible values are cdn \| api. - -## EventType - -Type: `string` - -The type of user action.
Possible values are login \| logout \| signup \| warpEnrollment \| profileUpdate \| transaction \| unknown \| passwordReset \| addPaymentMethod. - -## FraudEmailRisk - -Type: `string` - -Risk level of the email address.
Possible values are Unknown \| Low \| Medium \| High. - -## Host - -Type: `string` - -The HTTP hostname requested by the visitor. - -## JA4 - -Type: `string` - -The JA4 TLS client fingerprint. - -## RayID - -Type: `string` - -The RayID of the request. - -## Timestamp - -Type: `int or string` - -The date and time the event occurred. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## UserAgent - -Type: `string` - -The user-agent string of the visitor. - -## UserID - -Type: `string` - -A zone-unique identifier for the user, hex-encoded. Derived from the external user identifier provided during event submission. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/audit_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/audit_logs.md deleted file mode 100644 index a985d08b7fe..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/audit_logs.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Audit Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `audit_logs`. - -## ActionResult - -Type: `bool` - -Whether the action was successful. - -## ActionType - -Type: `string` - -Type of action taken. - -## ActorEmail - -Type: `string` - -Email of the actor. - -## ActorID - -Type: `string` - -Unique identifier of the actor in Cloudflare's system. - -## ActorIP - -Type: `string` - -Physical network address of the actor. - -## ActorType - -Type: `string` - -Type of user that started the audit trail. - -## ID - -Type: `string` - -Unique identifier of an audit log. - -## Interface - -Type: `string` - -Entry point or interface of the audit log. - -## Metadata - -Type: `object` - -Additional audit log-specific information. Metadata is organized in key:value pairs. Key and Value formats can vary by ResourceType. - -## NewValue - -Type: `object` - -Contains the new value for the audited item. - -## OldValue - -Type: `object` - -Contains the old value for the audited item. - -## OwnerID - -Type: `string` - -The identifier of the user that was acting or was acted on behalf of. If a user did the action themselves, this value will be the same as the ActorID. - -## ResourceID - -Type: `string` - -Unique identifier of the resource within Cloudflare's system. - -## ResourceType - -Type: `string` - -The type of resource that was changed. - -## When - -Type: `int or string` - -When the change happened. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/audit_logs_v2.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/audit_logs_v2.md deleted file mode 100644 index ab93f920ad9..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/audit_logs_v2.md +++ /dev/null @@ -1,148 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Audit Logs V2 -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `audit_logs_v2`. - -## AccountID - -Type: `string` - -The Cloudflare account ID. - -## AccountName - -Type: `string` - -The Cloudflare account name. - -## ActionDescription - -Type: `string` - -Description of action taken. - -## ActionResult - -Type: `string` - -Whether the action was successful. - -## ActionTimestamp - -Type: `int or string` - -When the change happened. - -## ActionType - -Type: `string` - -Type of action taken. - -## ActorContext - -Type: `string` - -Context of the actor. - -## ActorEmail - -Type: `string` - -Email of the actor. - -## ActorID - -Type: `string` - -Unique identifier of the actor in Cloudflare's system. - -## ActorIPAddress - -Type: `string` - -Physical network address of the actor. - -## ActorTokenDetails - -Type: `object` - -Details of how the actor is authenticated. - -## ActorType - -Type: `string` - -Type of user that started the audit trail. - -## AuditLogID - -Type: `string` - -Unique identifier of an audit log. - -## Raw - -Type: `object` - -Raw data. - -## ResourceID - -Type: `string` - -Unique identifier of the resource within Cloudflare's system. - -## ResourceProduct - -Type: `string` - -Resource product. - -## ResourceRequest - -Type: `object` - -Resource request. - -## ResourceResponse - -Type: `object` - -Resource response. - -## ResourceScope - -Type: `string` - -Resource scope. - -## ResourceType - -Type: `string` - -The type of resource that was changed. - -## ResourceValue - -Type: `object` - -Resource value. - -## ZoneID - -Type: `string` - -The Cloudflare zone ID. - -## ZoneName - -Type: `string` - -The Cloudflare zone name. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/biso_user_actions.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/biso_user_actions.md deleted file mode 100644 index 28ff1a906c1..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/biso_user_actions.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Browser Isolation User Actions -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `biso_user_actions`. - -## AccountID - -Type: `string` - -The Cloudflare account ID. - -## Decision - -Type: `string` - -The decision applied ('allow' or 'block'). - -## DomainName - -Type: `string` - -The domain name in the URL. - -## Metadata - -Type: `string` - -Additional information specific to a user action (JSON string). - -## Timestamp - -Type: `int or string` - -The date and time. - -## Type - -Type: `string` - -The user action type (for example, 'copy', 'paste', 'download'). - -## URL - -Type: `string` - -The URL of the webpage where a user action was performed. - -## UserEmail - -Type: `string` - -The user email. - -## UserID - -Type: `string` - -The user ID. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/casb_findings.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/casb_findings.md deleted file mode 100644 index 43ec4c9c0d8..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/casb_findings.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: CASB Findings -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `casb_findings`. - -## AssetDisplayName - -Type: `string` - -Asset display name (for example, 'My File Name.docx'). - -## AssetExternalID - -Type: `string` - -Unique identifier for an asset of this type. Format will vary by policy vendor. - -## AssetLink - -Type: `string` - -URL to the asset. This may not be available for some policy vendors and asset types. - -## AssetMetadata - -Type: `object` - -Metadata associated with the asset. Structure will vary by policy vendor. - -## DetectedTimestamp - -Type: `int or string` - -Date and time the finding was first identified (for example, '2021-07-27T00:01:07Z'). - -## FindingTypeDisplayName - -Type: `string` - -Human-readable name of the finding type (for example, 'File Publicly Accessible Read Only'). - -## FindingTypeID - -Type: `string` - -UUID of the finding type in Cloudflare's system. - -## FindingTypeSeverity - -Type: `string` - -Severity of the finding type (for example, 'High'). - -## InstanceID - -Type: `string` - -UUID of the finding in Cloudflare's system. - -## IntegrationDisplayName - -Type: `string` - -Human-readable name of the integration (for example, 'My Google Workspace Integration'). - -## IntegrationID - -Type: `string` - -UUID of the integration in Cloudflare's system. - -## IntegrationPolicyVendor - -Type: `string` - -Human-readable vendor name of the integration's policy (for example, 'Google Workspace Standard Policy'). diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/device_posture_results.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/device_posture_results.md deleted file mode 100644 index 96d08ebad34..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/device_posture_results.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Device posture results -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `device_posture_results`. - -## ClientVersion - -Type: `string` - -The Zero Trust client version at the time of upload. - -## DeviceID - -Type: `string` - -The device ID that performed the posture upload. - -## DeviceManufacturer - -Type: `string` - -The manufacturer of the device that the Zero Trust client is running on. - -## DeviceModel - -Type: `string` - -The model of the device that the Zero Trust client is running on. - -## DeviceName - -Type: `string` - -The name of the device that the Zero Trust client is running on. - -## DeviceSerialNumber - -Type: `string` - -The serial number of the device that the Zero Trust client is running on. - -## DeviceType - -Type: `string` - -The Zero Trust client operating system type. - -## Email - -Type: `string` - -The email used to register the device with the Zero Trust client. - -## OSVersion - -Type: `string` - -The operating system version at the time of upload. - -## PolicyID - -Type: `string` - -The posture check ID associated with this device posture result. - -## PostureCheckName - -Type: `string` - -The name of the posture check associated with this device posture result. - -## PostureCheckType - -Type: `string` - -The type of the Zero Trust client check or service provider check. - -## PostureEvaluatedResult - -Type: `bool` - -Whether this posture upload passes the associated posture check, given the requirements posture check at the time of the timestamp. - -## PostureExpectedJSON - -Type: `object` - -JSON object of what the posture check expects from the Zero Trust client. - -## PostureReceivedJSON - -Type: `object` - -JSON object of what the Zero Trust client actually uploads. - -## RegistrationID - -Type: `string` - -The UUID of the device registration associated with this posture result. - -## Timestamp - -Type: `int or string` - -The date and time the corresponding device posture upload was performed (for example, '2021-07-27T00:01:07Z'). To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## UserUID - -Type: `string` - -The uid of the user who registered the device. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/dex_application_tests.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/dex_application_tests.md deleted file mode 100644 index 81ec67e1507..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/dex_application_tests.md +++ /dev/null @@ -1,466 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: DEX Application Tests -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `dex_application_tests`. - -## AccountID - -Type: `string` - -The Cloudflare account ID. - -## ClientPlatform - -Type: `string` - -The client's operating system. - -## ClientVersion - -Type: `string` - -The WARP client version. - -## ColoCode - -Type: `string` - -The Colo code where the WARP client is connected to Cloudflare. - -## DeviceID - -Type: `string` - -The unique device ID. - -## DeviceRegistrationID - -Type: `string` - -The unique ID for the device registration. - -## ExecutionContext - -Type: `string` - -Whether the test traffic was run inside or outside of the tunnel. Can be `inTunnel` or `outOfTunnel`. - -## HTTPClientIPASN - -Type: `int` - -HTTP test client IP autonomous system number, for example `13335`. HTTP tests only. - -## HTTPClientIPASO - -Type: `string` - -HTTP test client IP autonomous system organization, for example `Cloudflare, Inc.`. HTTP tests only. - -## HTTPClientIPAddress - -Type: `string` - -HTTP test client IP address. HTTP tests only. - -## HTTPClientIPCity - -Type: `string` - -HTTP test client IP city name in English language, for example `Los Angeles`. HTTP tests only. - -## HTTPClientIPCountryISO - -Type: `string` - -HTTP test client IP country ISO code, for example `US` for the United States. HTTP tests only. - -## HTTPClientIPNetmask - -Type: `string` - -HTTP test client IP netmask. HTTP tests only. - -## HTTPClientIPStateISO - -Type: `string` - -HTTP test client IP state ISO code, for example `CA` for California. HTTP tests only. - -## HTTPClientIPVersion - -Type: `string` - -HTTP test client IP version. HTTP tests only. - -## HTTPClientIPZip - -Type: `string` - -HTTP test client IP postal code, for example `90001`. HTTP tests only. - -## HTTPConnectEndMs - -Type: `int` - -HTTP test result connect end, in milliseconds since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPConnectStartMs - -Type: `int` - -HTTP test result connect start, in milliseconds since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPDomainLookupEndMs - -Type: `int` - -HTTP test result domain lookup end, in milliseconds since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPDomainLookupStartMs - -Type: `int` - -HTTP test result domain lookup start, in milliseconds since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPErrorMessage - -Type: `string` - -HTTP test result error message. HTTP tests only. - -## HTTPMethod - -Type: `string` - -HTTP test method. HTTP tests only. - -## HTTPRedirectEndMs - -Type: `int` - -HTTP test redirect end timestamp, in milliseconds elapsed since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPRedirectStartMs - -Type: `int` - -HTTP test redirect start timestamp, in milliseconds elapsed since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPRequestStartMs - -Type: `int` - -HTTP test result request start, in milliseconds since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPResponseBody - -Type: `string` - -HTTP response body. HTTP tests only. - -## HTTPResponseBodyBytes - -Type: `int` - -Size of the HTTP response body. HTTP tests only. - -## HTTPResponseEndMs - -Type: `int` - -HTTP test result response end, in milliseconds since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPResponseHeaderBytes - -Type: `int` - -HTTP test result header bytes. HTTP tests only. - -## HTTPResponseHeaders - -Type: `array[object]` - -HTTP response headers, for example `[{"name": "Content-Type", "value": "text/html"}]`. HTTP tests only. - -## HTTPResponseStartMs - -Type: `int` - -HTTP test result response start, in milliseconds since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPSecureConnectionStartMs - -Type: `int` - -HTTP test result secure connection start, in milliseconds since test start. HTTP tests only. Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details. - -## HTTPServerIPASN - -Type: `int` - -HTTP test server IP autonomous system number, for example `13335`. HTTP tests only. - -## HTTPServerIPASO - -Type: `string` - -HTTP test server IP autonomous system organization, for example `Cloudflare, Inc.`. HTTP tests only. - -## HTTPServerIPAddress - -Type: `string` - -HTTP test server IP address. HTTP tests only. - -## HTTPServerIPCity - -Type: `string` - -HTTP test server IP city name in English language, for example `Los Angeles`. HTTP tests only. - -## HTTPServerIPCountryISO - -Type: `string` - -HTTP test server IP country ISO code, for example `US` for the United States. HTTP tests only. - -## HTTPServerIPNetmask - -Type: `string` - -HTTP test server IP netmask. HTTP tests only. - -## HTTPServerIPStateISO - -Type: `string` - -HTTP test server IP state ISO code, for example `CA` for California. HTTP tests only. - -## HTTPServerIPVersion - -Type: `string` - -HTTP test server IP version. HTTP tests only. - -## HTTPServerIPZip - -Type: `string` - -HTTP test server IP postal code, for example `90001`. HTTP tests only. - -## HTTPStatusCode - -Type: `int` - -HTTP test result status code. HTTP tests only. - -## HTTPURL - -Type: `string` - -HTTP test target URL. HTTP tests only. - -## TestID - -Type: `string` - -The test ID for which the result was uploaded. - -## TestType - -Type: `string` - -The type of test. Can be `traceroute` or `http`. - -## Timestamp - -Type: `int or string` - -Test start time. - -## TracerouteDestinationHostname - -Type: `string` - -Traceroute test result destination hostname. Traceroute tests only. - -## TracerouteDestinationIPASN - -Type: `int` - -Traceroute test destination IP autonomous system number, for example `13335`. Traceroute tests only. - -## TracerouteDestinationIPASO - -Type: `string` - -Traceroute test destination IP autonomous system organization, for example `Cloudflare, Inc.`. Traceroute tests only. - -## TracerouteDestinationIPAddress - -Type: `string` - -Traceroute test destination IP address. Traceroute tests only. - -## TracerouteDestinationIPCity - -Type: `string` - -Traceroute test destination IP city name in English language, for example `Los Angeles`. Traceroute tests only. - -## TracerouteDestinationIPCountryISO - -Type: `string` - -Traceroute test destination IP country ISO code, for example `US` for the United States. Traceroute tests only. - -## TracerouteDestinationIPNetmask - -Type: `string` - -Traceroute test destination IP netmask. Traceroute tests only. - -## TracerouteDestinationIPStateISO - -Type: `string` - -Traceroute test destination IP state ISO code, for example `CA` for California. Traceroute tests only. - -## TracerouteDestinationIPVersion - -Type: `string` - -Traceroute test destination IP version. Traceroute tests only. - -## TracerouteDestinationIPZip - -Type: `string` - -Traceroute test destination IP postal code, for example `90001`. Traceroute tests only. - -## TracerouteDurationMs - -Type: `int` - -Traceroute test result duration in milliseconds. Traceroute tests only. - -## TracerouteHops - -Type: `array[object]` - -Traceroute test result hops, for example `[{"errors": ["timeout", "host unreachable"], "ip": {"address": "192.0.2.0", "asn": 13335, "aso": "Cloudflare, Inc.", "location": {"city": "Los Angeles", "countryISO": "US", "stateISO": "CA", "zip": "90001"}, "netmask": "255.255.255.0", "version": "v4"}, "name": "router1.example.com", "pathID": 1, "received": 3, "rtts": [10, 12, 11], "sent": 3, "ttl": 60}]`. Traceroute tests only. - -## TracerouteMaxTTL - -Type: `int` - -Traceroute test result maximum TTL value. Traceroute tests only. - -## TracerouteProtocol - -Type: `string` - -Traceroute test result protocol. Can be `icmp`, `udp`, or `tcp`. Traceroute tests only. - -## TracerouteSize - -Type: `int` - -Traceroute test result packet size in bytes. Traceroute tests only. - -## TracerouteSourceIPASN - -Type: `int` - -Traceroute test source IP autonomous system number, for example `13335`. Traceroute tests only. - -## TracerouteSourceIPASO - -Type: `string` - -Traceroute test source IP autonomous system organization, for example `Cloudflare, Inc.`. Traceroute tests only. - -## TracerouteSourceIPAddress - -Type: `string` - -Traceroute test source IP address. Traceroute tests only. - -## TracerouteSourceIPCity - -Type: `string` - -Traceroute test source IP city name in English language, for example `Los Angeles`. Traceroute tests only. - -## TracerouteSourceIPCountryISO - -Type: `string` - -Traceroute test source IP country ISO code, for example `US` for the United States. Traceroute tests only. - -## TracerouteSourceIPNetmask - -Type: `string` - -Traceroute test source IP netmask. Traceroute tests only. - -## TracerouteSourceIPStateISO - -Type: `string` - -Traceroute test source IP state ISO code, for example `CA` for California. Traceroute tests only. - -## TracerouteSourceIPVersion - -Type: `string` - -Traceroute test source IP version. Traceroute tests only. - -## TracerouteSourceIPZip - -Type: `string` - -Traceroute test source IP postal code, for example `90001`. Traceroute tests only. - -## TracerouteStatus - -Type: `string` - -Traceroute test result status. Can be `destinationReached`, `lastHopFailed`, or `maxHopsExhausted`. Traceroute tests only. - -## TracerouteTimeEnd - -Type: `int or string` - -Traceroute test result time end. Traceroute tests only. - -## TracerouteVersion - -Type: `string` - -The version of the WARP traceroute client. Traceroute tests only. - -## TunnelType - -Type: `string` - -The tunnel type the device uses to establish a connection to the edge, if any. Can be `http2`, `masque`, or `wireguard`. - -## UserEmail - -Type: `string` - -The Access user email. - -## UserID - -Type: `string` - -The Access user ID. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/dex_device_state_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/dex_device_state_events.md deleted file mode 100644 index f05355e7589..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/dex_device_state_events.md +++ /dev/null @@ -1,370 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: DEX Device State Events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `dex_device_state_events`. - -## AccountID - -Type: `string` - -The Cloudflare account ID. - -## AlwaysOn - -Type: `bool` - -Whether the WARP daemon is configured to reconnect automatically or not. - -## AppFirewallEnabled - -Type: `bool` - -Whether the application-level firewall is enabled or disabled. - -## BatteryCharging - -Type: `bool` - -Whether the battery is charging or not. - -## BatteryCycles - -Type: `int` - -The number of battery cycles. May not be available on all platforms. - -## BatteryPercentage - -Type: `float` - -The percentage of battery remaining from 0 - 1. - -## CPUPercentage - -Type: `float` - -The percentage of CPU utilization from 0 - 1. - -## CPUPercentageByApp - -Type: `array[object]` - -The top applications by percentage of CPU used, for example `[{"name": "app0", "percentage": 0.55}, {"name": "app1", "percentage": 0.45}]`. - -## ClientPlatform - -Type: `string` - -The client's OS. - -## ClientVersion - -Type: `string` - -The WARP client version. - -## ConnectionType - -Type: `string` - -The type of connection the device has. Can be `cellular`, `ethernet`, or `wifi`. - -## DeviceID - -Type: `string` - -The unique device ID. - -## DeviceIPv4Address - -Type: `string` - -The device's private IPv4 address. - -## DeviceIPv4Netmask - -Type: `string` - -The device's private IPv4 netmask. - -## DeviceIPv6Address - -Type: `string` - -The device's private IPv6 address. - -## DeviceIPv6Netmask - -Type: `string` - -The device's private IPv6 netmask. - -## DeviceRegistrationID - -Type: `string` - -The unique ID for the device registration. - -## DeviceRegistrationProfileID - -Type: `string` - -The ID for the Device Profile used for the device registration. - -## DiskReadBPS - -Type: `int` - -The number of disk bytes read per second. - -## DiskUsagePercentage - -Type: `float` - -The percentage of disk used from 0 - 1. - -## DiskWriteBPS - -Type: `int` - -The number of disk bytes written per second. - -## DoHSubdomain - -Type: `string` - -The WARP client's DoH subdomain. - -## ExperimentalExtra - -Type: `object` - -Additional unstructured data sent by the WARP client. This field may change at any time. - -## FirewallEnabled - -Type: `bool` - -Whether the system-level firewall is enabled or disabled. - -## GatewayIPv4Address - -Type: `string` - -The private IPv4 address of the gateway/router the device is connected to. - -## GatewayIPv4Netmask - -Type: `string` - -The private IPv4 netmask of the gateway/router the device is connected to. - -## GatewayIPv6Address - -Type: `string` - -The private IPv6 address of the gateway/router the device is connected to. - -## GatewayIPv6Netmask - -Type: `string` - -The private IPv6 netmask of the gateway/router the device is connected to. - -## HandshakeLatencyMs - -Type: `int` - -When WARP is connected, the tunnel's estimated latency in milliseconds. When disconnected, -1. - -## ISPIPv4ASN - -Type: `int` - -The public IPv4 autonomous system number of the device assigned by the ISP, for example `13335`. - -## ISPIPv4ASO - -Type: `string` - -The public IPv4 autonomous system organization of the device assigned by the ISP, for example `Cloudflare Inc`. - -## ISPIPv4Address - -Type: `string` - -The public IPv4 address of the device assigned by the ISP. - -## ISPIPv4City - -Type: `string` - -The public IPv4 city name in English language of the device assigned by the ISP, for example `San Francisco`. - -## ISPIPv4CountryISO - -Type: `string` - -The public IPv4 country ISO code of the device assigned by the ISP, for example `US` for the United States. - -## ISPIPv4Netmask - -Type: `string` - -The public IPv4 netmask of the device assigned by the ISP. - -## ISPIPv4StateISO - -Type: `string` - -The public IPv4 state ISO code of the device assigned by the ISP, for example `CA` for California. - -## ISPIPv4Zip - -Type: `string` - -The public IPv4 postal code of the device assigned by the ISP, for example `90001`. - -## ISPIPv6ASN - -Type: `int` - -The public IPv6 autonomous system number of the device assigned by the ISP, for example `13335`. - -## ISPIPv6ASO - -Type: `string` - -The public IPv6 autonomous system organization of the device assigned by the ISP, for example `Cloudflare Inc`. - -## ISPIPv6Address - -Type: `string` - -The public IPv6 address of the device assigned by the ISP. - -## ISPIPv6City - -Type: `string` - -The public IPv6 city name in English language of the device assigned by the ISP, for example `San Francisco`. - -## ISPIPv6CountryISO - -Type: `string` - -The public IPv6 country ISO code of the device assigned by the ISP, for example `US` for the United States. - -## ISPIPv6Netmask - -Type: `string` - -The public IPv6 netmask of the device assigned by the ISP. - -## ISPIPv6StateISO - -Type: `string` - -The public IPv6 state ISO code of the device assigned by the ISP, for example `CA` for California. - -## ISPIPv6Zip - -Type: `string` - -The public IPv6 postal code of the device assigned by the ISP, for example `90001`. - -## Mode - -Type: `string` - -The WARP client connection mode, for example, `warp+doh`, `proxy`. - -## NetworkReceivedBPS - -Type: `int` - -The number of network bytes received per second. - -## NetworkSSID - -Type: `string` - -The SSID of the network the device is connected to, max 32 characters. - -## NetworkSentBPS - -Type: `int` - -The number of network bytes sent per second. - -## RAMAvailableKB - -Type: `int` - -The total available RAM in kilobytes. - -## RAMUsedPercentage - -Type: `float` - -The percentage of RAM utilization from 0 - 1. - -## RAMUsedPercentageByApp - -Type: `array[object]` - -The top applications by percentage of RAM used, for example `[{"name": "app0", "percentage": 0.55}, {"name": "app1", "percentage": 0.45}]`. - -## Status - -Type: `string` - -The WARP client connection status, for example, `connected`, `paused`. - -## SwitchLocked - -Type: `bool` - -Whether the WARP client was configured to always be enabled. - -## Timestamp - -Type: `int or string` - -Event timestamp. - -## TunnelStatsDownstream - -Type: `object` - -Warp Tunnel downstream stats, focused on MASQUE tunnels, for example `{"rttUs": 5, "minRttUs": 1, "rttVarUs": 1, "packetsSent": 100, "packetsLost": 50, "packetsRetransmitted": 25, "bytesSent": 1000, "bytesLost": 500, "bytesRetransmitted": 250}`. - -## TunnelStatsUpstream - -Type: `object` - -Warp Tunnel upstream stats, focused on MASQUE tunnels, for example `{"rttUs": 5, "minRttUs": 1, "rttVarUs": 1, "packetsSent": 100, "packetsLost": 50, "packetsRetransmitted": 25, "bytesSent": 1000, "bytesLost": 500, "bytesRetransmitted": 250}`. - -## TunnelType - -Type: `string` - -The tunnel type the device uses to establish a connection to the edge, if any. Can be `http2`, `masque`, or `wireguard`. - -## WarpColoCode - -Type: `string` - -The colo code where the client is connected to our API, for example, `DFW` or `none`. - -## WiFiStrengthDBM - -Type: `int` - -The WiFi strength in decibel milliwatts. Scale between -30 and -90. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/dlp_forensic_copies.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/dlp_forensic_copies.md deleted file mode 100644 index b8a45a75c01..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/dlp_forensic_copies.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: DLP Forensic Copies -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `dlp_forensic_copies`. - -## AccountID - -Type: `string` - -Cloudflare account ID. - -## Datetime - -Type: `int or string` - -The date and time the corresponding HTTP request was made. - -## ForensicCopyID - -Type: `string` - -The unique ID for this particular forensic copy. - -## GatewayRequestID - -Type: `string` - -Cloudflare request ID, as found in Gateway logs. - -## Headers - -Type: `object` - -String key-value pairs for a selection of HTTP headers on the associated request/response. - -## Payload - -Type: `string` - -Captured request/response data, base64-encoded. - -## Phase - -Type: `string` - -Phase of the HTTP request this forensic copy was captured from (that is, "request" or "response"). - -## TriggeredRuleID - -Type: `string` - -The ID of the Gateway firewall rule that triggered this forensic copy. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/dns_firewall_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/dns_firewall_logs.md deleted file mode 100644 index 76a2f2db3c7..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/dns_firewall_logs.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: DNS Firewall Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `dns_firewall_logs`. - -## ClientResponseCode - -Type: `int` - -Integer value of the response code Cloudflare presents to the client. Response code follows [IANA parameters](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6). - -## ClusterID - -Type: `string` - -The ID of the cluster which handled this request. - -## ColoCode - -Type: `string` - -IATA airport code of the data center that received the request. - -## EDNSSubnet - -Type: `string` - -IPv4 or IPv6 address information corresponding to the [EDNS Client Subnet (ECS)](/glossary/?term=ecs) forwarded by recursive resolvers. Not all resolvers send this information. - -## EDNSSubnetLength - -Type: `int` - -Size of the [EDNS Client Subnet (ECS)](/glossary/?term=ecs) in bits. For example, if the last octet of an IPv4 address is omitted (`192.0.2.x.`), the subnet length will be 24. - -## QueryDO - -Type: `bool` - -Indicates if the client is capable of handling a signed response (DNSSEC answer OK). - -## QueryName - -Type: `string` - -Name of the query that was sent. - -## QueryRD - -Type: `bool` - -Indicates if the client means a recursive query (Recursion Desired). - -## QuerySize - -Type: `int` - -The size of the query sent from the client in bytes. - -## QueryTCP - -Type: `bool` - -Indicates if the query from the client was made via TCP (if false, then UDP). - -## QueryType - -Type: `int` - -Integer value of query type. For more information refer to [Query type](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4). - -## ResponseCached - -Type: `bool` - -Whether the response was cached or not. - -## ResponseCachedStale - -Type: `bool` - -Whether the response was cached stale. In other words, the TTL had expired and the upstream nameserver was not reachable. - -## ResponseReason - -Type: `string` - -Short descriptions with more context around the final DNS Firewall response. Refer to [response reasons](/dns/dns-firewall/analytics/) for more information. - -## SourceIP - -Type: `string` - -IP address of the client (IPv4 or IPv6). - -## Timestamp - -Type: `int or string` - -Timestamp at which the query occurred. - -## UpstreamIP - -Type: `string` - -IP of the upstream nameserver (IPv4 or IPv6). - -## UpstreamResponseCode - -Type: `int` - -Integer value of the response code from the upstream nameserver. Response code follows [IANA parameters](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6) - -## UpstreamResponseTimeMs - -Type: `int` - -Upstream response time in milliseconds. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/email_security_alerts.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/email_security_alerts.md deleted file mode 100644 index 7c253043333..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/email_security_alerts.md +++ /dev/null @@ -1,202 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Email Security Alerts -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `email_security_alerts`. - -## AlertID - -Type: `string` - -The canonical ID for an Email Security Alert (for example, '4WtWkr6nlBz9sNH-2024-08-28T15:32:35'). - -## AlertReasons - -Type: `array[string]` - -Human-readable list of findings which contributed to this message's final disposition. - -## Attachments - -Type: `array[object]` - -List of objects containing metadata of attachments contained in this message (for example, [{"Md5": "91f073bd208689ddbd248e8989ecae90", "Sha1": "62b77e14e2c43049c45b5725018e78d0f9986930", "Sha256": "3b57505305e7162141fd898ed87d08f92fc42579b5047495859e56b3275a6c06", "Ssdeep": "McAQ8tPlH25e85Q2OiYpD08NvHmjJ97UfPMO47sekO:uN9M553OiiN/OJ9MM+e3", "Name": "attachment.gif", "ContentTypeProvided": "image/gif", "ContentTypeComputed": "application/x-msi", "Encrypted": true, "Decrypted": true}, ...]). - -## BCC - -Type: `array[string]` - -Email address portions of the BCC header provided by the sender, if present (for example, 'firstlast@cloudflare.com'). - -## CC - -Type: `array[string]` - -Email address portions of the CC header provided by the sender (for example, 'firstlast@cloudflare.com'). - -## CCName - -Type: `array[string]` - -Email address portions of the CC header provided by the sender (for example, 'First Last'). - -## DKIMResult - -Type: `string` - -Summary of the DKIM authentication result for the message.
Possible values are pass \| neutral \| fail \| error \| permerror \| temperror \| none. - -## DMARCPolicy - -Type: `string` - -Effective DMARC policy for the sending domain.
Possible values are none \| quarantine \| reject \| undefined. - -## DMARCResult - -Type: `string` - -Overall DMARC authentication result for the message.
Possible values are pass \| fail \| none. - -## FinalDisposition - -Type: `string` - -Final disposition attributed to the message.
Possible values are unset \| malicious \| suspicious \| spoof \| spam \| bulk. - -## From - -Type: `string` - -Email address portion of the From header provided by the sender (for example, 'firstlast@cloudflare.com'). - -## FromName - -Type: `string` - -Name portion of the From header provided by the sender (for example, 'First Last'). - -## Links - -Type: `array[string]` - -List of links detected in this message, benign or otherwise; limited to 100 in total. - -## MessageDeliveryMode - -Type: `string` - -The message's mode of transport to Email Security.
Possible values are unset \| api \| direct \| bcc \| journal \| retroScan. - -## MessageID - -Type: `string` - -Value of the Message-ID header provided by the sender. - -## Origin - -Type: `string` - -The origin of the message.
Possible values are unset \| internal \| external \| secondPartyInternal \| thirdPartyInternal \| outbound. - -## OriginalSender - -Type: `string` - -The original sender address as determined by Email Security mail processing (for example, 'firstlast@cloudflare.com'). - -## ReplyTo - -Type: `string` - -Email address portion of the Reply-To header provided by the sender (for example, 'firstlast@cloudflare.com'). - -## ReplyToName - -Type: `string` - -Name portion of the Reply-To header provided by the sender (for example, 'First Last'). - -## SMTPEnvelopeFrom - -Type: `string` - -Value of the SMTP MAIL FROM command provided by the sender (for example, 'First Last '). - -## SMTPEnvelopeTo - -Type: `array[string]` - -Values of the SMTP RCPT TO command provided by the sender (for example, 'First Last '). - -## SMTPHeloServerIP - -Type: `string` - -IPv4/v6 of the SMTP HELO server. - -## SMTPHeloServerIPAsName - -Type: `string` - -Autonomous System Name of the SMTP HELO server's IP. - -## SMTPHeloServerIPAsNumber - -Type: `string` - -Autonomous System Number of the SMTP HELO server's IP. - -## SMTPHeloServerIPGeo - -Type: `string` - -SMTP HELO server geolocation info (for example, 'US/NV/Las Vegas'). - -## SMTPHeloServerName - -Type: `string` - -Hostname provided by the SMTP HELO server. - -## SPFResult - -Type: `string` - -Summary of the SPF authentication result for the message.
Possible values are pass \| neutral \| fail \| softfail \| permerror \| temperror \| none. - -## Subject - -Type: `string` - -Value of the Subject header provided by the sender. - -## ThreatCategories - -Type: `array[string]` - -Threat categories attributed by Email Security processing (for example, 'CredentialHarvester', 'Dropper'). - -## Timestamp - -Type: `int or string` - -Start time of message processing (for example, '2024-08-28T15:32:35Z'). To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## To - -Type: `array[string]` - -Email address portions of the To header provided by the sender (for example, 'firstlast@cloudflare.com'). - -## ToName - -Type: `array[string]` - -Name portions of the To header provided by the sender (for example, 'First Last'). diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/email_security_post_delivery_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/email_security_post_delivery_events.md deleted file mode 100644 index 030506d97c1..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/email_security_post_delivery_events.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Email Security Post-Delivery Events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `email_security_post_delivery_events`. - -## AlertID - -Type: `string` - -Email Security alert ID for the original message. - -## CompletedAt - -Type: `int or string` - -The timestamp when the post-delivery action completed. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## Destination - -Type: `string` - -Target folder for MOVE operations (for example, 'RecoverableItemsPurges'). - -## FinalDisposition - -Type: `string` - -Threat disposition of the original message.
Possible values are unset \| none \| malicious \| suspicious \| spam \| spoof \| bulk. - -## Folder - -Type: `string` - -Resolved folder name after a successful MOVE. - -## From - -Type: `string` - -From header address of the original message (for example, 'firstlast@cloudflare.com'). - -## FromName - -Type: `string` - -From header display name of the original message (for example, 'First Last'). - -## MessageID - -Type: `string` - -RFC Message-ID header of the original message. - -## MessageTimestamp - -Type: `int or string` - -The timestamp of the original message. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## MicrosoftTenantID - -Type: `string` - -Microsoft 365 tenant identifier. - -## Operation - -Type: `string` - -Post-delivery action type.
Possible values are move \| submission \| quarantineRelease. - -## PostfixID - -Type: `string` - -Email Security postfix queue identifier for the original message. - -## Reasons - -Type: `array[string]` - -Detection findings that prompted the post-delivery action (for example, 'Malicious URL'). - -## Recipient - -Type: `string` - -Email address of the targeted mailbox (for example, 'firstlast@cloudflare.com'). - -## RequestedAt - -Type: `int or string` - -The timestamp when the post-delivery action was requested. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## RequestedBy - -Type: `string` - -Identity that requested the post-delivery action; expected format is an email address. - -## RequestedDisposition - -Type: `string` - -Requested disposition for SUBMISSION operations. - -## Status - -Type: `string` - -Status message returned by the post-delivery provider (for example, 'OK'). - -## Subject - -Type: `string` - -Subject header of the original message. - -## Success - -Type: `bool` - -Whether the post-delivery action succeeded. - -## To - -Type: `array[string]` - -Recipient addresses of the original message (for example, 'firstlast@cloudflare.com'). diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/firewall_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/firewall_events.md deleted file mode 100644 index ea2bbce8659..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/firewall_events.md +++ /dev/null @@ -1,292 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Firewall events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `firewall_events`. - -## AISecurityCustomTopicCategories - -Type: `object` - -Customer-defined AI Security topic labels and their relevance scores. A score of 1 indicates the highest relevance, and 99 indicates the lowest relevance. - -## AISecurityInjectionScore - -Type: `int` - -The score indicating the likelihood of a prompt injection attack in the request, as determined by AI Security. - -## AISecurityPIICategories - -Type: `array[string]` - -List of PII categories detected in the request by AI Security. - -## AISecurityTokenCount - -Type: `int` - -The number of tokens in the request, as counted by AI Security. - -## AISecurityUnsafeTopicCategories - -Type: `array[string]` - -List of unsafe topic categories detected in the request by AI Security. - -## Action - -Type: `string` - -The code of the first-class action the Cloudflare Firewall took on this request.
Possible actions are unknown \| allow \| block \| challenge \| jschallenge \| log \| connectionclose \| challengesolved \| challengebypassed \| jschallengesolved \| jschallengebypassed \| bypass \| managedchallenge \| managedchallengenoninteractivesolved \| managedchallengeinteractivesolved \| managedchallengebypassed \| precursorinterstitialpageissued \| precursorinterstitialpagebypassed \| precursorinterstitialpagesolved. - -## ClientASN - -Type: `int` - -The ASN of the visitor. - -## ClientASNDescription - -Type: `string` - -The ASN of the visitor as a string. - -## ClientCountry - -Type: `string` - -Country from which the request originated. - -## ClientIP - -Type: `string` - -The IP address of the visitor (IPv4 or IPv6). - -## ClientIPClass - -Type: `string` - -The classification of the visitor's IP address, possible values are: unknown \| badHost \| searchEngine \| allowlist \| monitoringService \| noRecord \| scan \| tor. - -## ClientRefererHost - -Type: `string` - -The referer host. - -## ClientRefererPath - -Type: `string` - -The referer path requested by the visitor. - -## ClientRefererQuery - -Type: `string` - -The referer query string requested by the visitor. - -## ClientRefererScheme - -Type: `string` - -The referer URL scheme requested by the visitor. - -## ClientRequestHost - -Type: `string` - -The HTTP hostname requested by the visitor. - -## ClientRequestMethod - -Type: `string` - -The HTTP method used by the visitor. - -## ClientRequestPath - -Type: `string` - -The path requested by the visitor. - -## ClientRequestProtocol - -Type: `string` - -The version of HTTP protocol requested by the visitor. - -## ClientRequestQuery - -Type: `string` - -The query string requested by the visitor. - -## ClientRequestScheme - -Type: `string` - -The URL scheme requested by the visitor. - -## ClientRequestUserAgent - -Type: `string` - -The user-agent string of the visitor. - -## ContentScanObjResults - -Type: `array[string]` - -List of content scan results. - -## ContentScanObjSizes - -Type: `array[int]` - -List of content object sizes. - -## ContentScanObjTypes - -Type: `array[string]` - -List of content types. - -## Datetime - -Type: `int or string` - -The date and time the event occurred at the edge. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## Description - -Type: `string` - -The description of the rule triggered by this request. - -## EdgeColoCode - -Type: `string` - -The airport code of the Cloudflare data center that served this request. - -## EdgeResponseStatus - -Type: `int` - -HTTP response status code returned to the browser. - -## FirewallForAIInjectionScore (deprecated) - -Type: `int` - -The score indicating the likelihood of a prompt injection attack in the request, as determined by Firewall for AI. Deprecated: Use AISecurityInjectionScore instead. - -## FirewallForAIPIICategories (deprecated) - -Type: `array[string]` - -List of PII categories detected in the request by Firewall for AI. Deprecated: Use AISecurityPIICategories instead. - -## FirewallForAITokenCount (deprecated) - -Type: `int` - -The number of tokens in the request, as counted by Firewall for AI. Deprecated: Use AISecurityTokenCount instead. - -## FirewallForAIUnsafeTopicCategories (deprecated) - -Type: `array[string]` - -List of unsafe topic categories detected in the request by Firewall for AI. Deprecated: Use AISecurityUnsafeTopicCategories instead. - -## FraudUserID - -Type: `string` - -A unique identifier generated by the Fraud Detection system for each user, generated during any action determined by the fraud event type. - -## Kind - -Type: `string` - -The kind of event, currently only possible values are: firewall. - -## LeakedCredentialCheckResult - -Type: `string` - -Result of the check for [leaked credentials](/waf/detections/leaked-credentials/).
Possible results are: password_leaked \| username_and_password_leaked \| username_password_similar \| username_leaked \| clean. - -## MatchIndex - -Type: `int` - -Rules match index in the chain. The last matching rule will have MatchIndex 0. If another rule matched before the last one, it will have MatchIndex 1. The same applies to any other matching rules, which will have a MatchIndex value of 2, 3, and so on. - -## Metadata - -Type: `object` - -Additional product-specific information. Metadata is organized in key:value pairs. Key and Value formats can vary by Cloudflare security product and can change over time. - -## OriginResponseStatus - -Type: `int` - -HTTP origin response status code returned to the browser. - -## OriginatorRayID - -Type: `string` - -The RayID of the request that issued the challenge/jschallenge. - -## RayID - -Type: `string` - -The RayID of the request. - -## Ref - -Type: `string` - -The user-defined identifier for the rule triggered by this request. Use refs to label your rules individually alongside the Cloudflare-provided RuleID. You can set refs via the [Rulesets API](/ruleset-engine/rulesets-api/) for some security products. - -## RuleID - -Type: `string` - -The Cloudflare security product-specific RuleID triggered by this request. - -## Source - -Type: `string` - -The Cloudflare security product triggered by this request.
Possible sources are unknown \| asn \| country \| ip \| iprange \| securitylevel \| zonelockdown \| waf \| firewallrules \| uablock \| ratelimit \| bic \| hot \| l7ddos \| validation \| botfight \| apishield \| botmanagement \| dlp \| firewallmanaged \| firewallcustom \| apishieldschemavalidation \| apishieldtokenvalidation \| apishieldsequencemitigation. - -## WAFRequestSignatureCategories - -Type: `array[string]` - -List of attack signature categories matched for the request. - -## WAFRequestSignatureRefs - -Type: `array[string]` - -List of attack signature rule references (refs) matched for the request. - -## ZoneName - -Type: `string` - -The human-readable name of the zone (for example, 'cloudflare.com'). diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_dns.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_dns.md deleted file mode 100644 index 8a7454612be..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_dns.md +++ /dev/null @@ -1,502 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Gateway DNS -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `gateway_dns`. - -## AccountID - -Type: `string` - -Cloudflare account ID. - -## ApplicationID - -Type: `int` - -ID of the application the domain belongs to (for example, 1, 2). Set to 0 when no ApplicationID is matched. - -## ApplicationName - -Type: `string` - -Name of the application the domain belongs to (for example, 'Cloudflare Dashboard'). - -## AppliedMaxTTL - -Type: `int` - -Maximum TTL cap applied to the response records, in seconds. Set to 0 when no cap was applied. - -## AuthoritativeNameServerIPs - -Type: `array[string]` - -The IPs of the authoritative nameservers that provided the answers, if any (for example ['203.0.113.1', '203.0.113.2']). - -## CNAMECategoryIDs - -Type: `array[int]` - -ID or IDs of category that the intermediate cname domains belongs to (for example, [7,12,28,122,129,163]). - -## CNAMECategoryNames - -Type: `array[string]` - -Name or names of category that the intermediate cname domains belongs to (for example, ['Photography', 'Weather']). - -## CNAMEs - -Type: `array[string]` - -Resolved intermediate cname domains (for example, ['alias.example.com']). - -## CNAMEsReversed - -Type: `array[string]` - -Resolved intermediate cname domains in reverse (for example, ['com.example.alias']). - -## ColoCode - -Type: `string` - -The name of the data center that received the DNS query (for example, 'SJC', 'MIA', 'IAD'). - -## ColoID - -Type: `int` - -The ID of the data center that received the DNS query (for example, 46, 72, 397). - -## CustomResolveDurationMs - -Type: `int` - -The time it took for the custom resolver to respond. - -## CustomResolverAddress - -Type: `string` - -IP and port combo used to resolve the custom dns resolver query, if any. - -## CustomResolverPolicyID (deprecated) - -Type: `string` - -Custom resolver policy UUID, if matched. Deprecated by ResolverPolicyID. - -## CustomResolverPolicyName (deprecated) - -Type: `string` - -Custom resolver policy name, if matched. Deprecated by ResolverPolicyName. - -## CustomResolverResponse - -Type: `string` - -Status of the custom resolver response. - -## Datetime - -Type: `int or string` - -The date and time the corresponding DNS request was made (for example, '2021-07-27T00:01:07Z'). - -## DeviceID - -Type: `string` - -UUID of the device where the HTTP request originated from (for example, 'dad71818-0429-11ec-a0dc-000000000000'). - -## DeviceName - -Type: `string` - -The name of the device where the HTTP request originated from (for example, 'Laptop MB810'). - -## DoHSubdomain - -Type: `string` - -The destination DoH subdomain the DNS query was made to. - -## DoTSubdomain - -Type: `string` - -The destination DoT subdomain the DNS query was made to. - -## DstIP - -Type: `string` - -The destination IP address the DNS query was made to (for example, '104.16.132.2290'). - -## DstPort - -Type: `int` - -The destination port used at the edge. The port changes based on the protocol used by the DNS query (for example, 0). - -## EDEErrors - -Type: `array[int]` - -List of returned Extended DNS Error Codes (for example, [2, 3]). - -## Email - -Type: `string` - -Email used to authenticate the client (for example, 'user@test.com'). - -## InitialCategoryIDs - -Type: `array[int]` - -ID or IDs of category that the queried domains belongs to (for example, [7,12,28,122,129,163]). - -## InitialCategoryNames - -Type: `array[string]` - -Name or names of category that the queried domains belongs to (for example, ['Photography', 'Weather']). - -## InitialResolvedIPs - -Type: `array[string]` - -The IPs used to correlate existing FQDN matching policy between Gateway DNS and Gateway proxy. - -## InternalDNSDurationMs - -Type: `int` - -The time it took for the internal DNS to respond. - -## InternalDNSFallbackStrategy - -Type: `string` - -The fallback strategy applied over the internal DNS response. Empty if no fallback strategy was applied. - -## InternalDNSRCode - -Type: `int` - -The return code sent back by the internal DNS service. - -## InternalDNSViewID - -Type: `string` - -The DNS internal view identifier that was sent to the internal DNS service. - -## InternalDNSZoneID - -Type: `string` - -The DNS zone identifier returned by the internal DNS service. - -## IsResponseCached - -Type: `bool` - -Response comes from cache or not. - -## Location - -Type: `string` - -Name of the location the DNS request is coming from. Location is created by the customer (for example, 'Office NYC'). - -## LocationID - -Type: `string` - -UUID of the location the DNS request is coming from. Location is created by the customer (for example, '7bdc7a9c-81d3-4816-8e56-000000000000'). - -## MatchedCategoryIDs - -Type: `array[int]` - -ID or IDs of category that the domain was matched with the policy (for example, [7,12,28,122,129,163]). - -## MatchedCategoryNames - -Type: `array[string]` - -Name or names of category that the domain was matched with the policy (for example, ['Photography', 'Weather']). - -## MatchedIndicatorFeedIDs - -Type: `array[int]` - -ID or IDs of indicator feed(s) that the domain was matched with the policy (for example, [7,12]). - -## MatchedIndicatorFeedNames - -Type: `array[string]` - -Name or names of indicator feed(s) that the domain was matched with the policy (for example, ['Vendor Malware Feed', 'Vendor CoC Feed']). - -## Policy (deprecated) - -Type: `string` - -Name of the policy that was applied (if any) (for example, '7bdc7a9c-81d3-4816-8e56-de1acad3dec5'). - -## PolicyID - -Type: `string` - -ID of the policy/rule that was applied (if any). - -## PolicyName - -Type: `string` - -Name of the policy that was applied (if any). - -## Protocol - -Type: `string` - -The protocol used for the DNS query by the client (for example, 'udp'). - -## QueryApplicationIDs - -Type: `array[int]` - -ID or IDs of applications the queried domain belongs to (for example, [1, 51]) - -## QueryApplicationNames - -Type: `array[string]` - -Name or names of applications the queried domain belongs to (for example, ['Cloudflare Dashboard']) - -## QueryCategoryIDs - -Type: `array[int]` - -Union of all categories; Initial categories + Resolved IP categories + Cname intermediate categories - -## QueryCategoryNames - -Type: `array[string]` - -Union of all category names; Initial categories + Resolved IP categories + Cname intermediate categories - -## QueryID - -Type: `string` - -Globally unique identifier of the query. - -## QueryIndicatorFeedIDs - -Type: `array[int]` - -ID or IDs of indicator feed(s) that the domain belongs to (for example, [7,12,28]). - -## QueryIndicatorFeedNames - -Type: `array[string]` - -Name or names of indicator feed(s) that the domain belongs to (for example, ['Vendor Malware Feed', 'Vendor CoC Feed', 'Vendor Phishing Feed']). - -## QueryName - -Type: `string` - -The query name (for example, 'example.com'). Cloudflare will surface '.' for root server queries in your logs. - -## QueryNameReversed - -Type: `string` - -Query name in reverse (for example, 'com.example'). Cloudflare will surface '.' for root server queries in your logs. - -## QuerySize - -Type: `int` - -The size of the DNS request in bytes (for example, 151). - -## QueryType - -Type: `int` - -The type of DNS query (for example, 1, 28, 15, or 16). - -## QueryTypeName - -Type: `string` - -The type of DNS query (for example, 'A', 'AAAA', 'MX', or 'TXT'). - -## RCode - -Type: `int` - -The return code sent back by the DNS resolver. - -## RData (deprecated) - -Type: `array[object]` - -The rdata objects (for example, [{"type":"5","data":"dns-packet-placeholder..."}]). - -## RedirectTargetURI - -Type: `string` - -Custom URI to which the user was redirected, if any. - -## RegistrationID - -Type: `string` - -The UUID of the device registration from which the HTTP request originated (for example, 'dad71818-0429-11ec-a0dc-000000000000'). - -## RequestContextCategoryIDs - -Type: `array[int]` - -ID or IDs of the category that was sent to gateway in the EDNS request for filtering (for example, [7,12,28,122,129,163]). - -## RequestContextCategoryNames - -Type: `array[string]` - -Name or names of the category that was sent to gateway in the EDNS request for filtering (for example, ['Photography', 'Weather']). - -## ResolvedIPCategoryIDs - -Type: `array[int]` - -ID or IDs of category that the ips in the response belongs to (for example, [7,12,28,122,129,163]). - -## ResolvedIPCategoryNames - -Type: `array[string]` - -Name or names of category that the ips in the response belongs to (for example, ['Photography', 'Weather']). - -## ResolvedIPContinentCodes - -Type: `array[string]` - -Continent code of each resolved IP, if any (for example ['NA', 'EU']). - -## ResolvedIPCountryCodes - -Type: `array[string]` - -Country code of each resolved IP, if any (for example ['US', 'PT']). - -## ResolvedIPs - -Type: `array[string]` - -The resolved IPs in the response, if any (for example ['203.0.113.1', '203.0.113.2']). - -## ResolverDecision - -Type: `string` - -Result of the DNS query (for example, 'overrideForSafeSearch'). - -## ResolverPolicyID - -Type: `string` - -Resolver policy UUID, if any matched. - -## ResolverPolicyName - -Type: `string` - -Resolver policy name, if any matched. - -## ResourceRecords - -Type: `array[object]` - -The rdata objects (for example, [{"type":"5","data":"dns-packet-placeholder..."}]). - -## ResourceRecordsJSON - -Type: `string` - -String that represents the JSON array with the returned resource records (for example, '[{"name": "example.com", "type": "CNAME", "class": "IN", "ttl": 3600, "rdata": "cname.example.com."}]'). - -## ResponseTimeMs - -Type: `int` - -Total response time of the DNS request in milliseconds. - -## SrcIP - -Type: `string` - -The source IP address making the DNS query (for example, '104.16.132.229'). - -## SrcIPContinentCode - -Type: `string` - -Continent code of the source IP address making the DNS query (for example, 'NA'). - -## SrcIPCountryCode - -Type: `string` - -Country code of the source IP address making the DNS query (for example, 'US'). - -## SrcPort - -Type: `int` - -The port used by the client when they sent the DNS request (for example, 0). - -## TenantID - -Type: `string` - -The tenant ID of the DNS request, if exists. - -## TimeZone - -Type: `string` - -Time zone used to calculate the current time, if a matched rule was scheduled with it. - -## TimeZoneInferredMethod - -Type: `string` - -Method used to pick the time zone for the schedule (from rule/ from user ip/ from local time). - -## UpstreamRecordTTLs - -Type: `array[int]` - -TTL of each record in the upstream response, in seconds. Maps one-to-one with the resource records (for example, [3600, 300]). - -## UserID - -Type: `string` - -User identity where the HTTP request originated from (for example, '00000000-0000-0000-0000-000000000000'). diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_http.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_http.md deleted file mode 100644 index 4f75f9f5c83..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_http.md +++ /dev/null @@ -1,382 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Gateway HTTP -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `gateway_http`. - -## AccountID - -Type: `string` - -Cloudflare account tag. - -## Action - -Type: `string` - -Action performed by gateway on the HTTP request. - -## AddedHeaders - -Type: `array[string]` - -Headers added to the HTTP request by a Gateway rule. - -## AppControlInfo - -Type: `object` - -Information about application control operations, APIs, and groups that matched the HTTP request. - -## ApplicationIDs - -Type: `array[int]` - -IDs of the applications that matched the HTTP request parameters. - -## ApplicationNames - -Type: `array[string]` - -Names of the applications that matched the HTTP request parameters. - -## ApplicationStatuses - -Type: `array[string]` - -Statuses of the applications that matched the HTTP request parameters. - -## BlockedFileHash - -Type: `string` - -Hash of the file blocked in the response, if any. - -## BlockedFileName - -Type: `string` - -File name blocked in the request, if any. - -## BlockedFileReason - -Type: `string` - -Reason file was blocked in the response, if any. - -## BlockedFileSize - -Type: `int` - -File size(bytes) blocked in the response, if any. - -## BlockedFileType - -Type: `string` - -File type blocked in the response eg. exe, bin, if any. - -## CategoryIDs - -Type: `array[int]` - -IDs of the categories that matched the HTTP request parameters. - -## CategoryNames - -Type: `array[string]` - -Names of the categories that matched the HTTP request parameters. - -## Datetime - -Type: `int or string` - -The date and time the corresponding HTTP request was made. - -## DeletedHeaders - -Type: `array[string]` - -Names of headers that were deleted from the HTTP request by a Gateway rule. - -## DestinationIP - -Type: `string` - -Destination ip of the request. - -## DestinationIPContinentCode - -Type: `string` - -Continent code of the destination IP of the HTTP request (for example, 'NA'). - -## DestinationIPCountryCode - -Type: `string` - -Country code of the destination IP of the HTTP request (for example, 'US'). - -## DestinationPort - -Type: `int` - -Destination port of the request. - -## DeviceID - -Type: `string` - -UUID of the device where the HTTP request originated from. - -## DeviceName - -Type: `string` - -The name of the device where the HTTP request originated from (for example, 'Laptop MB810'). - -## DownloadMatchedDlpProfileEntries - -Type: `array[string]` - -List of matched DLP entries in the HTTP request. - -## DownloadMatchedDlpProfiles - -Type: `array[string]` - -List of matched DLP profiles in the HTTP request. - -## DownloadedFileNames - -Type: `array[string]` - -List of files downloaded in the HTTP request. - -## Email - -Type: `string` - -Email used to authenticate the client. - -## ExperimentalFeatures - -Type: `object` - -Experimental features which will be either permanently added to the schema or marked for deprecation. In that case, they will be removed 3 months after the notice. Current fields: 'mcp' - If MCP traffic was detected or not. - -## FileInfo - -Type: `object` - -Information about files detected within the HTTP request. - -## ForensicCopyStatus - -Type: `string` - -Status of any associated forensic copies that may have been captured during the request. - -## HTTPHost - -Type: `string` - -Content of the host header in the HTTP request. - -## HTTPMethod - -Type: `string` - -HTTP request method. - -## HTTPStatusCode - -Type: `int` - -HTTP status code gateway returned to the user. Zero if nothing was returned (for example, client disconnected). - -## HTTPVersion - -Type: `string` - -Version name for the HTTP request. - -## IsIsolated - -Type: `bool` - -If the requested was isolated with Cloudflare Browser Isolation or not. - -## PackageInfo - -Type: `object` - -Information about the software package detected in the HTTP request, including its ecosystem, namespace, name, version, and package URL (PURL). - -## PolicyID - -Type: `string` - -The gateway policy UUID applied to the request, if any. - -## PolicyName - -Type: `string` - -The name of the gateway policy applied to the request, if any. - -## PrivateAppAUD - -Type: `string` - -The private app AUD, if any. - -## ProxyEndpoint - -Type: `string` - -The proxy endpoint used on the HTTP request, if any. - -## Quarantined - -Type: `bool` - -If the request content was quarantined. - -## RedirectTargetURI - -Type: `string` - -Custom URI to which the user was redirected, if any. - -## Referer - -Type: `string` - -Contents of the referer header in the HTTP request. - -## RegistrationID - -Type: `string` - -The UUID of the device registration from which the HTTP request originated. - -## RequestID - -Type: `string` - -Cloudflare request ID. This might be empty on bypass action. - -## SessionID - -Type: `string` - -Network session ID. - -## SetHeaders - -Type: `array[string]` - -Names of headers that were set (overwritten) on the HTTP request by a Gateway rule. - -## SourceIP - -Type: `string` - -Source ip of the request. - -## SourceIPContinentCode - -Type: `string` - -Continent code of the source IP of the request (for example, 'NA'). - -## SourceIPCountryCode - -Type: `string` - -Country code of the source IP of the request (for example, 'US'). - -## SourceInternalIP - -Type: `string` - -Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp. - -## SourcePort - -Type: `int` - -Source port of the request. - -## TenantID - -Type: `string` - -The tenant ID of the request, if exists. - -## URL - -Type: `string` - -HTTP request URL. - -## UntrustedCertificateAction - -Type: `string` - -Action taken when an untrusted origin certificate error occurs (for example, expired certificate, mismatched common name, invalid certificate chain, signed by non-public CA). One of none \| block \| error \| passThrough. - -## UploadMatchedDlpProfileEntries - -Type: `array[string]` - -List of matched DLP entries in the HTTP request. - -## UploadMatchedDlpProfiles - -Type: `array[string]` - -List of matched DLP profiles in the HTTP request. - -## UploadedFileNames - -Type: `array[string]` - -List of files uploaded in the HTTP request. - -## UserAgent - -Type: `string` - -Contents of the user agent header in the HTTP request. - -## UserID - -Type: `string` - -User identity where the HTTP request originated from. - -## VirtualNetworkID - -Type: `string` - -The identifier of the virtual network the device was connected to, if any. - -## VirtualNetworkName - -Type: `string` - -The name of the virtual network the device was connected to, if any. - -## Warnings - -Type: `array[string]` - -Warnings generated during request processing. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_network.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_network.md deleted file mode 100644 index a2b617a3ee5..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_network.md +++ /dev/null @@ -1,214 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Gateway Network -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `gateway_network`. - -## AccountID - -Type: `string` - -Cloudflare account tag. - -## Action - -Type: `string` - -Action performed by gateway on the session. - -## ApplicationIDs - -Type: `array[int]` - -IDs of the applications that matched the session parameters. - -## ApplicationNames - -Type: `array[string]` - -Names of the applications that matched the session parameters. - -## CategoryIDs - -Type: `array[int]` - -IDs of the categories that matched the session parameters. - -## CategoryNames - -Type: `array[string]` - -Names of the categories that matched the session parameters. - -## Datetime - -Type: `int or string` - -The date and time the corresponding network session was made (for example, '2021-07-27T00:01:07Z'). - -## DestinationIP - -Type: `string` - -Destination IP of the network session. - -## DestinationIPContinentCode - -Type: `string` - -Continent code of the destination IP of the network session (for example, 'NA'). - -## DestinationIPCountryCode - -Type: `string` - -Country code of the destination IP of the network session (for example, 'US'). - -## DestinationPort - -Type: `int` - -Destination port of the network session. - -## DetectedProtocol - -Type: `string` - -Detected traffic protocol of the network session. - -## DeviceID - -Type: `string` - -UUID of the device where the network session originated from. - -## DeviceName - -Type: `string` - -The name of the device where the HTTP request originated from (for example, 'Laptop MB810'). - -## Email - -Type: `string` - -Email associated with the user identity where the network session originated from. - -## OverrideIP - -Type: `string` - -Overridden IP of the network session, if any. - -## OverridePort - -Type: `int` - -Overridden port of the network session, if any. - -## PolicyID - -Type: `string` - -Identifier of the policy/rule that was applied, if any. - -## PolicyName - -Type: `string` - -The name of the gateway policy applied to the request, if any. - -## ProxyEndpoint - -Type: `string` - -The proxy endpoint used on this network session, if any. - -## RegistrationID - -Type: `string` - -The UUID of the device registration from which the network session originated. - -## SNI - -Type: `string` - -Content of the SNI for the TLS network session, if any. - -## SessionID - -Type: `string` - -The session identifier of this network session. - -## SourceIP - -Type: `string` - -Source IP of the network session. - -## SourceIPContinentCode - -Type: `string` - -Continent code of the source IP of the network session (for example, 'NA'). - -## SourceIPCountryCode - -Type: `string` - -Country code of the source IP of the network session (for example, 'US'). - -## SourceInternalIP - -Type: `string` - -Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp. - -## SourcePort - -Type: `int` - -Source port of the network session. - -## TenantID - -Type: `string` - -The tenant ID of the network session, if exists. - -## Transport (deprecated) - -Type: `string` - -Transport protocol used for this session.
Possible values are tcp \| quic \| udp. Deprecated, please use TransportProtocol instead. - -## TransportProtocol - -Type: `string` - -Transport protocol used for this session.
Possible values are tcp \| quic \| udp. - -## UserID - -Type: `string` - -User identity where the network session originated from. - -## VirtualNetworkID - -Type: `string` - -The identifier of the virtual network the device was connected to, if any. - -## VirtualNetworkName - -Type: `string` - -The name of the virtual network the device was connected to, if any. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/ipsec_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/ipsec_logs.md deleted file mode 100644 index e7f2f505891..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/ipsec_logs.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: IPSec Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `ipsec_logs`. - -## Level - -Type: `string` - -The level of the log. - -## LocalIP - -Type: `string` - -The local IP address associated with the log. - -## LocalPort - -Type: `int` - -The local port associated with the log. - -## Message - -Type: `string` - -The log message. IKEv2 ciphersuite is logged here for handshake messages. - -## RemoteIP - -Type: `string` - -The remote IP address associated with the log. - -## RemotePort - -Type: `int` - -The remote port associated with the log. - -## Timestamp - -Type: `int or string` - -Timestamp at which the log occurred. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/magic_bgp_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/magic_bgp_logs.md deleted file mode 100644 index bed8dba606f..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/magic_bgp_logs.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Magic BGP Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `magic_bgp_logs`. - -## Direction - -Type: `string` - -Direction of the event relative to Cloudflare. Possible values are to_cloudflare \| from_cloudflare, or empty for non-message events. - -## EventData - -Type: `object` - -Payload describing the event. Schema depends on `EventKind`.
open_message carries `peer_asn`, `cloudflare_asn`, `bgp_id`, `hold_time`, and `capabilities`.
update_message carries `announced`, `as_path`, and `origin`.
notification_message carries `code`, `subcode`, and `reason`.
route_refresh_message carries `afi` and `safi`.
bgp_state_transition carries `from_state`, `to_state`, and `event`.
tcp_handshake_failed carries `reason`, `message`, `src`, and `dst`.
stale_path_timer_expired carries `purged_route_count`.
session_config_changed carries `disabled` and the changed fields.
filter_config_changed carries `import` and `export` filter change flags.
redistribute_config_changed carries a single boolean. - -## EventKind - -Type: `string` - -BGP event type. Possible values are open_message \| update_message \| notification_message \| route_refresh_message \| bgp_state_transition \| tcp_handshake_failed \| stale_path_timer_expired \| session_config_changed \| filter_config_changed \| redistribute_config_changed. - -## EventTimestamp - -Type: `int or string` - -Timestamp of when the event occurred. - -## TunnelID - -Type: `string` - -UUID (hex, no hyphens) of the IPsec / GRE tunnel the event belongs to. - -## TunnelName - -Type: `string` - -Name of the IPsec / GRE tunnel the event belongs to. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/magic_ids_detections.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/magic_ids_detections.md deleted file mode 100644 index c02ba58e2d3..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/magic_ids_detections.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Magic IDS Detections -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `magic_ids_detections`. - -## Action - -Type: `string` - -What action was taken on the packet. Possible values are pass \| block. - -## ColoCity - -Type: `string` - -The city where the detection occurred. - -## ColoCode - -Type: `string` - -The IATA airport code corresponding to where the detection occurred. - -## DestinationIP - -Type: `string` - -The destination IP of the packet which triggered the detection. - -## DestinationPort - -Type: `int` - -The destination port of the packet which triggered the detection. It is set to 0 if the protocol field is set to any. - -## Protocol - -Type: `string` - -The layer 4 protocol of the packet which triggered the detection. Possible values are tcp \| udp \| any. Variant any means a detection occurred at a lower layer (such as IP). - -## SignatureID - -Type: `int` - -The signature ID of the detection. - -## SignatureMessage - -Type: `string` - -The signature message of the detection. Describes what the packet is attempting to do. - -## SignatureRevision - -Type: `int` - -The signature revision of the detection. - -## SourceIP - -Type: `string` - -The source IP of packet which triggered the detection. - -## SourcePort - -Type: `int` - -The source port of the packet which triggered the detection. It is set to 0 if the protocol field is set to any. - -## Timestamp - -Type: `int or string` - -A timestamp of when the detection occurred. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/mcp_portal_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/mcp_portal_logs.md deleted file mode 100644 index 82b7f47d333..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/mcp_portal_logs.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: MCP Portal Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `mcp_portal_logs`. - -## ClientCountry - -Type: `string` - -Country code of the client IP address. - -## ClientIP - -Type: `string` - -IP address of the client that initiated the request. - -## ColoCode - -Type: `string` - -Colo code of the data center that processed the request (for example, 'DFW'). - -## Datetime - -Type: `int or string` - -The date and time the request was made. - -## Error - -Type: `string` - -The error message if the request failed and there is additional information. - -## Method - -Type: `string` - -The JSON-RPC method of the request (for example, 'tools/call', 'prompts/get', 'resources/read'). - -## PortalAUD - -Type: `string` - -Audience tag of the MCP Portal. - -## PortalID - -Type: `string` - -Unique identifier of the MCP Portal. - -## PromptGetName - -Type: `string` - -For prompts/get requests, the name of the prompt being fetched. - -## ResourceReadURI - -Type: `string` - -For resources/read requests, the URI of the resource being fetched. - -## ServerAUD - -Type: `string` - -Audience tag of the upstream MCP Server. - -## ServerID - -Type: `string` - -Unique identifier of the upstream MCP Server. - -## ServerResponseDurationMs - -Type: `int` - -The time in milliseconds it took for the upstream MCP server to respond. - -## ServerURL - -Type: `string` - -URL of the upstream MCP Server. - -## SessionID - -Type: `string` - -Unique identifier of the stateful MCP session associated with the request. - -## Success - -Type: `bool` - -If the request succeeded. - -## ToolCallName - -Type: `string` - -For tools/call requests, the name of the tool being called. - -## UserEmail - -Type: `string` - -Email address of the authenticated user who performed the request. - -## UserID - -Type: `string` - -Unique identifier of the authenticated user who performed the request. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/mnm_flow_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/mnm_flow_logs.md deleted file mode 100644 index f9ec3ebe100..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/mnm_flow_logs.md +++ /dev/null @@ -1,154 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Magic Network Monitoring Flow Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `mnm_flow_logs`. - -## AWSVPCFlowJSON - -Type: `string` - -AWS VPC Flow Logs JSON data. Only set if the flow protocol is AWS_VPC. - -## Bits - -Type: `int` - -The number of bits transmitted. - -## DestinationAS - -Type: `int` - -The autonomous system number of the destination. - -## DestinationAddress - -Type: `string` - -The destination IP address. - -## DestinationPort - -Type: `int` - -The destination port number. - -## DeviceID - -Type: `string` - -The ID of the network device (such as a router or switch) that originated the flow. - -## EgressBits - -Type: `int` - -The number of egress bits transmitted. - -## EgressPackets - -Type: `int` - -The number of egress packets transmitted. - -## Ethertype - -Type: `int` - -The ethertype of the packet (for example, 2048 for IPv4, 34525 for IPv6). - -## FlowProtocol - -Type: `string` - -The flow protocol (for example, 'AWS_VPC', 'IPFIX', 'SFLOW_5', 'NETFLOW_V9'). - -## FlowTimestamp - -Type: `int or string` - -The timestamp of the flow. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## NumFlows - -Type: `int` - -The number of flows. - -## PacketID - -Type: `string` - -The packet ID. - -## Packets - -Type: `int` - -The number of packets transmitted. - -## Protocol - -Type: `int` - -The protocol number (for example, 6 for TCP, 17 for UDP). - -## RuleIDs - -Type: `string` - -Comma-separated list of Magic Network Monitoring rule IDs associated with the flow, if any. - -## SampleRate - -Type: `int` - -The sample rate of the flow set by the sampler (1, 100, 1000, 1024, 2000 are common). - -## SampleRateType - -Type: `string` - -The type of sample rate (for example, 'flow', 'default', 'propagated'). - -## SamplerAddress - -Type: `string` - -The sampler IP address. - -## SourceAS - -Type: `int` - -The autonomous system number of the source. - -## SourceAddress - -Type: `string` - -The source IP address. - -## SourcePort - -Type: `int` - -The source port number. - -## TcpFlags - -Type: `int` - -The TCP flags. - -## Timestamp - -Type: `int or string` - -The date and time of the event. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/network_analytics_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/network_analytics_logs.md deleted file mode 100644 index 7d1de308973..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/network_analytics_logs.md +++ /dev/null @@ -1,514 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Network Analytics Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `network_analytics_logs`. - -## AttackCampaignID - -Type: `string` - -Unique identifier of the attack campaign that this packet was a part of, if any. - -## AttackID - -Type: `string` - -Unique identifier of the mitigation that matched the packet, if any. - -## AttackVector - -Type: `string` - -Descriptive name of the type of attack that this packet was a part of, if any. Only for packets matching rules contained within the Cloudflare L3/4 managed ruleset. - -## ColoCity - -Type: `string` - -The city where the Cloudflare data center that received the packet is located. - -## ColoCode - -Type: `string` - -The Cloudflare data center that received the packet (nearest IATA airport code). - -## ColoCountry - -Type: `string` - -The country where the Cloudflare data center that received the packet is located (ISO 3166-1 alpha-2). - -## ColoGeoHash - -Type: `string` - -The latitude and longitude where the Cloudflare data center that received the packet is located (Geohash encoding). - -## ColoName - -Type: `string` - -The unique site identifier of the Cloudflare data center that received the packet (for example, 'ams01', 'sjc01', 'lhr01'). - -## DNSQueryName - -Type: `string` - -The DNS query name (domain) that was queried, if the packet is a DNS query. - -## DNSQueryType - -Type: `string` - -The DNS query type (for example, A, AAAA, MX, TXT), if the packet is a DNS query. - -## Datetime - -Type: `int or string` - -The date and time the event occurred at the edge. - -## DestinationASN - -Type: `int` - -The ASN associated with the destination IP of the packet. - -## DestinationASNName - -Type: `string` - -The name of the ASN associated with the destination IP of the packet. - -## DestinationCountry - -Type: `string` - -The country where the destination IP of the packet is located (ISO 3166-1 alpha-2). - -## DestinationGeoHash - -Type: `string` - -The latitude and longitude where the destination IP of the packet is located (Geohash encoding). - -## DestinationPort - -Type: `int` - -Value of the Destination Port header field in the TCP or UDP packet. - -## Direction - -Type: `string` - -The direction in relation to customer network.
Possible values are ingress \| egress. - -## GREChecksum - -Type: `int` - -Value of the Checksum header field in the GRE packet. - -## GREEtherType - -Type: `int` - -Value of the EtherType header field in the GRE packet. - -## GREHeaderLength - -Type: `int` - -Length of the GRE packet header, in bytes. - -## GREKey - -Type: `int` - -Value of the Key header field in the GRE packet. - -## GRESequenceNumber - -Type: `int` - -Value of the Sequence Number header field in the GRE packet. - -## GREVersion - -Type: `int` - -Value of the Version header field in the GRE packet. - -## ICMPChecksum - -Type: `int` - -Value of the Checksum header field in the ICMP packet. - -## ICMPCode - -Type: `int` - -Value of the Code header field in the ICMP packet. - -## ICMPType - -Type: `int` - -Value of the Type header field in the ICMP packet. - -## IPDestinationAddress - -Type: `string` - -Value of the Destination Address header field in the IPv4 or IPv6 packet. - -## IPDestinationSubnet - -Type: `string` - -Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6). - -## IPFragmentOffset - -Type: `int` - -Value of the Fragment Offset header field in the IPv4 or IPv6 packet. - -## IPHeaderLength - -Type: `int` - -Length of the IPv4 or IPv6 packet header, in bytes. - -## IPMoreFragments - -Type: `int` - -Value of the More Fragments header field in the IPv4 or IPv6 packet. - -## IPProtocol - -Type: `int` - -Value of the Protocol header field in the IPv4 or IPv6 packet. - -## IPProtocolName - -Type: `string` - -Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet. - -## IPSourceAddress - -Type: `string` - -Value of the Source Address header field in the IPv4 or IPv6 packet. - -## IPSourceSubnet - -Type: `string` - -Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6). - -## IPTTL - -Type: `int` - -Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet. - -## IPTTLBuckets - -Type: `int` - -Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated. - -## IPTotalLength - -Type: `int` - -Total length of the IPv4 or IPv6 packet, in bytes. - -## IPTotalLengthBuckets - -Type: `int` - -Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated. - -## IPv4Checksum - -Type: `int` - -Value of the Checksum header field in the IPv4 packet. - -## IPv4DSCP - -Type: `int` - -Value of the Differentiated Services Code Point header field in the IPv4 packet. - -## IPv4DontFragment - -Type: `int` - -Value of the Don't Fragment header field in the IPv4 packet. - -## IPv4ECN - -Type: `int` - -Value of the Explicit Congestion Notification header field in the IPv4 packet. - -## IPv4Identification - -Type: `int` - -Value of the Identification header field in the IPv4 packet. - -## IPv4Options - -Type: `string` - -List of Options numbers included in the IPv4 packet header. - -## IPv6DSCP - -Type: `int` - -Value of the Differentiated Services Code Point header field in the IPv6 packet. - -## IPv6ECN - -Type: `int` - -Value of the Explicit Congestion Notification header field in the IPv6 packet. - -## IPv6ExtensionHeaders - -Type: `string` - -List of Extension Header numbers included in the IPv6 packet header. - -## IPv6FlowLabel - -Type: `int` - -Value of the Flow Label header field in the IPv6 packet. - -## IPv6Identification - -Type: `int` - -Value of the Identification extension header field in the IPv6 packet. - -## MitigationReason - -Type: `string` - -Reason for applying a mitigation to the packet, if any.
Possible values are BLOCKED \| RATE_LIMITED \|UNEXPECTED \| CHALLENGE_NEEDED \| CHALLENGE_PASSED \| NOT_FOUND \| OUT_OF_SEQUENCE \| ALREADY_CLOSED. - -## MitigationScope - -Type: `string` - -Whether the packet matched a local or global mitigation, if any.
Possible values are local \| global. - -## MitigationSystem - -Type: `string` - -Which Cloudflare system sampled the packet.
Possible values are dosd \| flowtrackd \| magic-firewall. - -## Outcome - -Type: `string` - -The action that Cloudflare systems took on the packet.
Possible values are pass \| drop. - -## PFPCustomTag - -Type: `int` - -The custom network analytics tag set by Programmable Flow Protection program, if any. - -## ProtocolState - -Type: `string` - -State of the packet in the context of the protocol, if any.
Possible values are OPEN \| NEW \| CLOSING \| CLOSED. - -## RuleID - -Type: `string` - -Unique identifier of the rule contained within the Cloudflare L3/4 managed ruleset that this packet matched, if any. - -## RuleName - -Type: `string` - -Human-readable name of the rule contained within the Cloudflare L3/4 managed ruleset that this packet matched, if any. - -## RulesetID - -Type: `string` - -Unique identifier of the Cloudflare L3/4 managed ruleset containing the rule that this packet matched, if any.
Possible values are 3b64149bfa6e4220bbbc2bd6db589552. - -## RulesetOverrideID - -Type: `string` - -Unique identifier of the rule within the accounts root ddos_l4 phase ruleset which resulted in an override of the default sensitivity or action being applied/evaluated, if any. - -## SampleInterval - -Type: `int` - -The sample interval is the inverse of the sample rate. For example, a sample interval of 1000 means that this packet was randomly sampled from 1 in 1000 packets. Sample rates are dynamic and based on the volume of traffic. - -## SourceASN - -Type: `int` - -The ASN associated with the source IP of the packet. - -## SourceASNName - -Type: `string` - -The name of the ASN associated with the source IP of the packet. - -## SourceCountry - -Type: `string` - -The country where the source IP of the packet is located (ISO 3166-1 alpha-2). - -## SourceGeoHash - -Type: `string` - -The latitude and longitude where the source IP of the packet is located (Geohash encoding). - -## SourcePort - -Type: `int` - -Value of the Source Port header field in the TCP or UDP packet. - -## TCPAcknowledgementNumber - -Type: `int` - -Value of the Acknowledgement Number header field in the TCP packet. - -## TCPChecksum - -Type: `int` - -Value of the Checksum header field in the TCP packet. - -## TCPDataOffset - -Type: `int` - -Value of the Data Offset header field in the TCP packet. - -## TCPFlags - -Type: `int` - -Value of the Flags header field in the TCP packet. - -## TCPFlagsString - -Type: `string` - -Human-readable string representation of the Flags header field in the TCP packet. - -## TCPMSS - -Type: `int` - -Value of the MSS option header field in the TCP packet. - -## TCPOptions - -Type: `string` - -List of Options numbers included in the TCP packet header. - -## TCPSACKBlocks - -Type: `string` - -List of the SACK Blocks option header in the TCP packet. - -## TCPSACKPermitted - -Type: `int` - -Value of the SACK Permitted option header in the TCP packet. - -## TCPSequenceNumber - -Type: `int` - -Value of the Sequence Number header field in the TCP packet. - -## TCPTimestampECR - -Type: `int` - -Value of the Timestamp Echo Reply option header in the TCP packet. - -## TCPTimestampValue - -Type: `int` - -Value of the Timestamp option header in the TCP packet. - -## TCPUrgentPointer - -Type: `int` - -Value of the Urgent Pointer header field in the TCP packet. - -## TCPWindowScale - -Type: `int` - -Value of the Window Scale option header in the TCP packet. - -## TCPWindowSize - -Type: `int` - -Value of the Window Size header field in the TCP packet. - -## UDPChecksum - -Type: `int` - -Value of the Checksum header field in the UDP packet. - -## UDPPayloadLength - -Type: `int` - -Value of the Payload Length header field in the UDP packet. - -## Verdict - -Type: `string` - -The action that Cloudflare systems think should be taken on the packet.
Possible values are pass \| drop. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/sinkhole_http_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/sinkhole_http_logs.md deleted file mode 100644 index c12a87c022a..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/sinkhole_http_logs.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Sinkhole HTTP Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `sinkhole_http_logs`. - -## AccountID - -Type: `string` - -The Account ID. - -## Body - -Type: `string` - -The request body. - -## BodyLength - -Type: `int` - -The length of request body. - -## DestAddr - -Type: `string` - -The destination IP address of the request. - -## Headers - -Type: `string` - -The request headers. If a header has multiple values, the values are comma separated. Each header is separated by the escaped newline character (\n). - -## Host - -Type: `string` - -The host the request was sent to. - -## Method - -Type: `string` - -The request method. - -## Password - -Type: `string` - -The request password. - -## R2Path - -Type: `string` - -The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes. - -## Referrer - -Type: `string` - -The referrer of the request. - -## SinkholeID - -Type: `string` - -The ID of the Sinkhole that logged the HTTP Request. - -## SrcAddr - -Type: `string` - -The sender's IP address. - -## Timestamp - -Type: `int or string` - -The date and time the sinkhole HTTP request was logged. - -## URI - -Type: `string` - -The request Uniform Resource Identifier. - -## URL - -Type: `string` - -The request Uniform Resource Locator. - -## UserAgent - -Type: `string` - -The request user agent. - -## Username - -Type: `string` - -The request username. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/ssh_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/ssh_logs.md deleted file mode 100644 index 94c26946ebe..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/ssh_logs.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: SSH Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `ssh_logs`. - -## AccountID - -Type: `string` - -Cloudflare account ID. - -## ClientAddress - -Type: `string` - -The source address of the SSH command. - -## Datetime - -Type: `int or string` - -The timestamp in UTC of when this message is being sent. - -## Error - -Type: `string` - -An SSH error. Only used if an error has occurred. - -## PTY - -Type: `string` - -This is used by certain programs types to synchronize local and remote SSH terminal state. - -## Payload - -Type: `string` - -The captured request/response data, in asciicast v2 format. This includes the command associated with the 'exec' program type. - -## ProgramFinishDatetime - -Type: `int or string` - -The timestamp in UTC of the SSH program termination. This is empty until the program ends. - -## ProgramID - -Type: `string` - -The SSH program ID. A single SSH session can have multiple programs running. - -## ProgramStartDatetime - -Type: `int or string` - -The timestamp in UTC of the SSH program creation. - -## ProgramType - -Type: `string` - -The SSH program being run. The options are 'shell': opens an interactive terminal, 'exec': execute a single specified command, 'x11': is for an interactive graphical environment, 'direct-tcpip': direct tunneling, 'forwarded-tcpip': reverse tunneling. - -## ServerAddress - -Type: `string` - -The destination address for the SSH session. - -## SessionFinishDatetime - -Type: `int or string` - -The timestamp in UTC of the SSH session termination. This is empty until the session ends. - -## SessionID - -Type: `string` - -SSH session ID. - -## SessionStartDatetime - -Type: `int or string` - -The timestamp in UTC of the SSH session creation. - -## TargetID - -Type: `string` - -The identifier of the target being accessed. - -## UserEmail - -Type: `string` - -User email address. - -## UserID - -Type: `string` - -Cloudflare user ID. - -## Username - -Type: `string` - -The principal user being accessed on SSH server's machine. This will be empty if an error was thrown when establishing the connection. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/turnstile_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/turnstile_events.md deleted file mode 100644 index c1699e0422a..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/turnstile_events.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Turnstile Events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `turnstile_events`. - -## ASN - -Type: `int` - -The visitor's autonomous system number (ASN). - -## Action - -Type: `string` - -The Turnstile widget action string configured by the customer. - -## BrowserMajor - -Type: `int` - -The major version of the visitor's browser. - -## BrowserName - -Type: `string` - -The name of the visitor's browser (for example, 'Chrome', 'Firefox'). - -## ClientIP - -Type: `string` - -IP address of the visitor. - -## CountryCode - -Type: `string` - -The 2-letter ISO-3166 country code of the visitor. - -## EventType - -Type: `string` - -The type of Turnstile event. Possible values are challenge_issued \| challenge_non_interactive_solved \| challenge_interactive_solved \| challenge_non_interactive_siteverify_solved \| challenge_interactive_siteverify_solved \| challenge_clearance_siteverify_solved \| challenge_siteverify_failed_double_redemption \| challenge_siteverify_failed_invalid_token \| challenge_siteverify_failed_other \| challenge_siteverify_ratelimited. - -## Hostname - -Type: `string` - -The hostname where the Turnstile widget was loaded. - -## OSMajor - -Type: `int` - -The major version of the visitor's operating system. - -## OSName - -Type: `string` - -The name of the visitor's operating system (for example, 'Windows', 'macOS'). - -## Sitekey - -Type: `string` - -The Turnstile sitekey (widget identifier). - -## Timestamp - -Type: `int or string` - -The date and time the event was logged. - -## UserAgent - -Type: `string` - -The visitor's full user agent string. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/warp_config_changes.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/warp_config_changes.md deleted file mode 100644 index 901a8a42d27..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/warp_config_changes.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: WARP Config Changes -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `warp_config_changes`. - -## AccountIDFrom - -Type: `string` - -The Cloudflare account ID the user switched from. - -## AccountIDTo - -Type: `string` - -The Cloudflare account ID the user switched to. - -## AccountNameFrom - -Type: `string` - -The name of the account the user switched from. - -## AccountNameTo - -Type: `string` - -The name of the account the user switched to. - -## ConfigNameFrom - -Type: `string` - -The name of the config the user switched from. - -## ConfigNameTo - -Type: `string` - -The name of the config the user switched to. - -## DeviceID - -Type: `string` - -Physical device ID. - -## DeviceRegistrationID - -Type: `string` - -Device registration ID. - -## Hostname - -Type: `string` - -The device hostname. - -## SerialNumber - -Type: `string` - -The device serial number. - -## Timestamp - -Type: `int or string` - -Time the event was ingested. - -## UserEmail - -Type: `string` - -The Access user email. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/warp_toggle_changes.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/warp_toggle_changes.md deleted file mode 100644 index 185bb3cdbbd..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/warp_toggle_changes.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: WARP Toggle Changes -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `warp_toggle_changes`. - -## AccountID - -Type: `string` - -The Cloudflare account ID when the toggle happened. - -## AccountName - -Type: `string` - -The account name when the toggle happened. - -## DeviceID - -Type: `string` - -Physical device ID. - -## DeviceRegistrationID - -Type: `string` - -Device registration ID. - -## Hostname - -Type: `string` - -The device hostname. - -## SerialNumber - -Type: `string` - -The device serial number. - -## Timestamp - -Type: `int or string` - -Time the event was ingested. - -## Toggled - -Type: `bool` - -Indicates whether the device was toggled or not. - -## UserEmail - -Type: `string` - -The Access user email. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/websocket_analytics.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/websocket_analytics.md deleted file mode 100644 index 5a7d728be5b..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/websocket_analytics.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: WebSocket Analytics -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `websocket_analytics`. - -## BytesReceivedClient - -Type: `int` - -Number of bytes received from the client. - -## BytesReceivedOrigin - -Type: `int` - -Number of bytes received from the origin. - -## BytesSentClient - -Type: `int` - -Number of bytes sent to the client. - -## BytesSentOrigin - -Type: `int` - -Number of bytes sent to the origin. - -## ClientASN - -Type: `int` - -The client's autonomous system number (ASN). - -## ClientIP - -Type: `string` - -The client IP address. - -## ClientRequestHost - -Type: `string` - -The host requested by the client in the WebSocket upgrade request. - -## ClientRequestPath - -Type: `string` - -The path requested by the client in the WebSocket upgrade request. - -## ClientRequestUserAgent - -Type: `string` - -The user agent reported by the client. - -## ColoCode - -Type: `string` - -IATA airport code of the data center that handled the connection. - -## ConnectionCloseReason - -Type: `string` - -The reason the WebSocket connection ended.
Possible values are none \| unspecifiedError \| timedOut \| peerReset \| upstreamReset \| protocolViolation \| peerNoError. - -## ConnectionCloseSource - -Type: `string` - -Which side initiated the connection close.
Possible values are upstream \| downstream \| me \| both, or the raw internal value if unrecognized. - -## ConnectionID - -Type: `string` - -Unique identifier of the WebSocket connection, hex-encoded. - -## ConnectionTransportCloseCode - -Type: `int` - -The first transport-level close code observed. For TLS connections this is the TLS alert code; for plain TCP connections (no TLS) it is always 0. The most significant bit indicates the source: 0 = proxy-initiated, 1 = eyeball-initiated. - -## EdgeEndTimestamp - -Type: `int or string` - -Timestamp at which the WebSocket connection closed. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## EdgeStartTimestamp - -Type: `int or string` - -Timestamp at which the WebSocket connection was established. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## RayID - -Type: `string` - -The Ray ID of the WebSocket upgrade request. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/workers_trace_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/workers_trace_events.md deleted file mode 100644 index 1deee04b5cc..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/workers_trace_events.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Workers Trace Events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `workers_trace_events`. - -## CPUTimeMs - -Type: `int` - -The amount of CPU time used by the Worker script, in milliseconds. - -## DispatchNamespace - -Type: `string` - -The Cloudflare Worker dispatch namespace. - -## Entrypoint - -Type: `string` - -The name of the entrypoint class in which the Worker began execution. - -## Event - -Type: `object` - -Details about the source event. - -## EventTimestampMs - -Type: `int` - -The timestamp of when the event was received, in milliseconds. - -## EventType - -Type: `string` - -The event type that triggered the invocation.
Possible values are fetch \| scheduled \| alarm \| queue \| email \| worker_rpc \| hibernatable_web_socket. - -## Exceptions - -Type: `array[object]` - -List of uncaught exceptions during the invocation. - -## Logs - -Type: `array[object]` - -List of console messages emitted during the invocation. - -## Outcome - -Type: `string` - -The outcome of the Worker script invocation.
Possible values are ok \| canceled \| exception \| unknown. - -## ScriptName - -Type: `string` - -The Cloudflare Worker script name. - -## ScriptTags - -Type: `array[string]` - -A list of user-defined tags used to categorize the Worker. - -## ScriptVersion - -Type: `object` - -The version of the script that was invoked. - -## WallTimeMs - -Type: `int` - -The elapsed time in milliseconds between the start of a Worker invocation, and when the Workers Runtime determines that no more JavaScript needs to run. Specifically, this measures the wall-clock time that the JavaScript context remained open. For example, when returning a response with a large body, the Workers runtime can, in some cases, determine that no more JavaScript needs to run, and closes the JS context before all the bytes have passed through and been sent. Alternatively, if you use the `waitUntil()` API to perform work without blocking the return of a response, this work may continue executing after the response has been returned, and will be included in `WallTimeMs`. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md deleted file mode 100644 index 6a5f1a6ca1c..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md +++ /dev/null @@ -1,270 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Zero Trust Network Session Logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -Network session logs are generated for all traffic proxied through Cloudflare Gateway across all supported [on-ramps](/cloudflare-one/networks/connectivity-options/), such as the Cloudflare One Client (WARP), proxy endpoints (PAC files), Browser Isolation, and Cloudflare Tunnel. - -The descriptions below detail the fields available for `zero_trust_network_sessions`. - -## AccountID - -Type: `string` - -Cloudflare account ID. - -## BytesReceived - -Type: `int` - -The number of bytes sent from the origin to the client during the network session. - -## BytesSent - -Type: `int` - -The number of bytes sent from the client to the origin during the network session. - -## ClientTCPHandshakeDurationMs - -Type: `int` - -Duration of handshaking the TCP connection between the client and Cloudflare in milliseconds. - -## ClientTLSCipher - -Type: `string` - -TLS cipher suite used in the connection between the client and Cloudflare. - -## ClientTLSHandshakeDurationMs - -Type: `int` - -Duration of handshaking the TLS connection between the client and Cloudflare in milliseconds. - -## ClientTLSVersion - -Type: `string` - -TLS protocol version used in the connection between the client and Cloudflare. - -## ConnectionCloseReason - -Type: `string` - -The reason for closing the connection, only applicable for TCP.
Possible values are CLIENT_CLOSED \| CLIENT_IDLE_TIMEOUT \| CLIENT_TLS_ERROR \| CLIENT_ERROR \| ORIGIN_CLOSED \| ORIGIN_TLS_ERROR \| ORIGIN_ERROR \| ORIGIN_UNREACHABLE \| ORIGIN_UNROUTABLE \| PROXY_CONN_REFUSED \| UNKNOWN \| MISMATCHED_IP_VERSIONS \| TOO_MANY_ACTIVE_SESSIONS_FOR_ACCOUNT \| TOO_MANY_ACTIVE_SESSIONS_FOR_USER \| TOO_MANY_NEW_SESSIONS_FOR_ACCOUNT \| TOO_MANY_NEW_SESSIONS_FOR_USER. - -## ConnectionReuse - -Type: `bool` - -Whether the TCP connection was reused for multiple HTTP requests. - -## DestinationTunnelID - -Type: `string` - -Identifier of the Cloudflare One connector to which the network session was routed to, if any, such as Cloudflare Tunnel or WARP device. - -## DetectedProtocol - -Type: `string` - -Detected traffic protocol of the network session. - -## DeviceID - -Type: `string` - -Identifier of the client device which initiated the network session, if applicable, (for example, WARP Device ID). - -## DeviceName - -Type: `string` - -Name of the client device which initiated the network session, if applicable, (for example, WARP Device ID). - -## EgressColoName - -Type: `string` - -The name of the Cloudflare data center from which traffic egressed to the origin. - -## EgressIP - -Type: `string` - -Source IP used when egressing traffic from Cloudflare to the origin. - -## EgressPort - -Type: `int` - -Source port used when egressing traffic from Cloudflare to the origin. - -## EgressRuleID - -Type: `string` - -Identifier of the egress rule that was applied by the Secure Web Gateway, if any. - -## EgressRuleName - -Type: `string` - -The name of the egress rule that was applied by the Secure Web Gateway, if any. - -## Email - -Type: `string` - -Email address associated with the user identity which initiated the network session. - -## IngressColoName - -Type: `string` - -The name of the Cloudflare data center to which traffic ingressed. - -## InitialOriginIP - -Type: `string` - -The IP used to correlate existing FQDN matching policy between Gateway DNS and Gateway proxy. - -## Offramp - -Type: `string` - -The type of destination to which the network session was routed.
Possible values are INTERNET \| MAGIC \| CFD_TUNNEL \| WARP. - -## OriginIP - -Type: `string` - -The IP of the destination ("origin") for the network session. - -## OriginPort - -Type: `int` - -The port of the destination origin for the network session. - -## OriginTLSCertificateIssuer - -Type: `string` - -The issuer of the origin TLS certificate. - -## OriginTLSCertificateValidationResult - -Type: `string` - -The result of validating the TLS certificate of the origin.
Possible values are VALID \| EXPIRED \| REVOKED \| HOSTNAME_MISMATCH \| NONE \| UNKNOWN. - -## OriginTLSCipher - -Type: `string` - -TLS cipher suite used in the connection between Cloudflare and the origin. - -## OriginTLSHandshakeDurationMs - -Type: `int` - -Duration of handshaking the TLS connection between Cloudflare and the origin in milliseconds. - -## OriginTLSVersion - -Type: `string` - -TLS protocol version used in the connection between Cloudflare and the origin. - -## Protocol - -Type: `string` - -Network protocol used for this network session.
Possible values are TCP \| UDP \| ICMP \| ICMPV6. - -## RegistrationID - -Type: `string` - -Identifier of the client registration which initiated the network session, if applicable (for example, WARP Registration ID). - -## ResolvedFQDN - -Type: `string` - -The fully qualified domain name of the destination. - -## RuleEvaluationDurationMs - -Type: `int` - -The duration taken by Secure Web Gateway applying applicable Network, HTTP, and Egress rules to the network session in milliseconds. - -## SNI - -Type: `string` - -The server name indication (SNI) value from the TLS handshake, if applicable. - -## SessionEndTime - -Type: `int or string` - -The network session end timestamp with nanosecond precision. - -## SessionID - -Type: `string` - -The identifier of this network session. - -## SessionStartTime - -Type: `int or string` - -The network session start timestamp with nanosecond precision. - -## SourceIP - -Type: `string` - -Source IP of the network session. - -## SourceInternalIP - -Type: `string` - -Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp. - -## SourcePort - -Type: `int` - -Source port of the network session. - -## TenantID - -Type: `string` - -The tenant ID of the network session, if exists. - -## UserID - -Type: `string` - -User identity where the network session originated from. Only applicable for WARP device clients. - -## VirtualNetworkID - -Type: `string` - -Identifier of the virtual network configured for the client. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/account_abuse_protection_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/account_abuse_protection_events.md deleted file mode 100644 index 4bfb240b946..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/account_abuse_protection_events.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Account Abuse Protection Events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `account_abuse_protection_events`. - -## AuthenticationIdentityProvider - -Type: `string` - -The identity provider used for login authentication. Only populated for login events.
Possible values are unknown \| other \| selfHosted \| amazon \| apple \| discord \| facebook \| github \| linkedin \| microsoft. - -## AuthenticationMethod - -Type: `string` - -The authentication method used for login. Only populated for login events.
Possible values are unknown \| password \| sso \| magicLink \| biometric \| passkey. - -## AuthenticationStatus - -Type: `string` - -The outcome of a login attempt. Only populated for login events.
Possible values are unknown \| other \| success \| failureOther \| failureUserNotFound \| failureIncorrectPassword \| failureAccountLocked \| pendingMfa. - -## BotScore - -Type: `int` - -Cloudflare Bot Management score. Values from 1 (likely bot) to 99 (likely human). - -## ClientASN - -Type: `int` - -Client AS number. - -## ClientCity - -Type: `string` - -Approximate city of the client. - -## ClientCountry - -Type: `string` - -2-letter ISO-3166 country code of the client IP address. - -## ClientIP - -Type: `string` - -IP address of the client. - -## Email - -Type: `string` - -The email address associated with the event. - -## EphemeralID - -Type: `string` - -The Turnstile ephemeral device identifier, hex-encoded. - -## EventSource - -Type: `string` - -The source of the Account Abuse Protection event.
Possible values are cdn \| api. - -## EventType - -Type: `string` - -The type of user action.
Possible values are login \| logout \| signup \| warpEnrollment \| profileUpdate \| transaction \| unknown \| passwordReset \| addPaymentMethod. - -## FraudEmailRisk - -Type: `string` - -Risk level of the email address.
Possible values are Unknown \| Low \| Medium \| High. - -## Host - -Type: `string` - -The HTTP hostname requested by the visitor. - -## JA4 - -Type: `string` - -The JA4 TLS client fingerprint. - -## RayID - -Type: `string` - -The RayID of the request. - -## Timestamp - -Type: `int or string` - -The date and time the event occurred. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## UserAgent - -Type: `string` - -The user-agent string of the visitor. - -## UserID - -Type: `string` - -A zone-unique identifier for the user, hex-encoded. Derived from the external user identifier provided during event submission. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/dns_logs.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/dns_logs.md deleted file mode 100644 index f21b39be05e..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/dns_logs.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: DNS logs -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `dns_logs`. - -## ColoCode - -Type: `string` - -IATA airport code of the data center that received the request. - -## EDNSSubnet - -Type: `string` - -IPv4 or IPv6 address information corresponding to the [EDNS Client Subnet (ECS)](/glossary/?term=ecs) forwarded by recursive resolvers. Not all resolvers send this information. - -## EDNSSubnetLength - -Type: `int` - -Size of the [EDNS Client Subnet (ECS)](/glossary/?term=ecs) in bits. For example, if the last octet of an IPv4 address is omitted (`192.0.2.x.`), the subnet length will be 24. - -## QueryName - -Type: `string` - -Name of the query that was sent. - -## QueryType - -Type: `int` - -Integer value of query type. For more information refer to [Query type](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4). - -## ResponseCached - -Type: `bool` - -Whether the response was cached or not. - -## ResponseCode - -Type: `int` - -Integer value of response code. For more information refer to [Response code](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6). - -## SourceIP - -Type: `string` - -IP address of the client (IPv4 or IPv6). - -## Timestamp - -Type: `int or string` - -Timestamp at which the query occurred. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/firewall_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/firewall_events.md deleted file mode 100644 index ea2bbce8659..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/firewall_events.md +++ /dev/null @@ -1,292 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Firewall events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `firewall_events`. - -## AISecurityCustomTopicCategories - -Type: `object` - -Customer-defined AI Security topic labels and their relevance scores. A score of 1 indicates the highest relevance, and 99 indicates the lowest relevance. - -## AISecurityInjectionScore - -Type: `int` - -The score indicating the likelihood of a prompt injection attack in the request, as determined by AI Security. - -## AISecurityPIICategories - -Type: `array[string]` - -List of PII categories detected in the request by AI Security. - -## AISecurityTokenCount - -Type: `int` - -The number of tokens in the request, as counted by AI Security. - -## AISecurityUnsafeTopicCategories - -Type: `array[string]` - -List of unsafe topic categories detected in the request by AI Security. - -## Action - -Type: `string` - -The code of the first-class action the Cloudflare Firewall took on this request.
Possible actions are unknown \| allow \| block \| challenge \| jschallenge \| log \| connectionclose \| challengesolved \| challengebypassed \| jschallengesolved \| jschallengebypassed \| bypass \| managedchallenge \| managedchallengenoninteractivesolved \| managedchallengeinteractivesolved \| managedchallengebypassed \| precursorinterstitialpageissued \| precursorinterstitialpagebypassed \| precursorinterstitialpagesolved. - -## ClientASN - -Type: `int` - -The ASN of the visitor. - -## ClientASNDescription - -Type: `string` - -The ASN of the visitor as a string. - -## ClientCountry - -Type: `string` - -Country from which the request originated. - -## ClientIP - -Type: `string` - -The IP address of the visitor (IPv4 or IPv6). - -## ClientIPClass - -Type: `string` - -The classification of the visitor's IP address, possible values are: unknown \| badHost \| searchEngine \| allowlist \| monitoringService \| noRecord \| scan \| tor. - -## ClientRefererHost - -Type: `string` - -The referer host. - -## ClientRefererPath - -Type: `string` - -The referer path requested by the visitor. - -## ClientRefererQuery - -Type: `string` - -The referer query string requested by the visitor. - -## ClientRefererScheme - -Type: `string` - -The referer URL scheme requested by the visitor. - -## ClientRequestHost - -Type: `string` - -The HTTP hostname requested by the visitor. - -## ClientRequestMethod - -Type: `string` - -The HTTP method used by the visitor. - -## ClientRequestPath - -Type: `string` - -The path requested by the visitor. - -## ClientRequestProtocol - -Type: `string` - -The version of HTTP protocol requested by the visitor. - -## ClientRequestQuery - -Type: `string` - -The query string requested by the visitor. - -## ClientRequestScheme - -Type: `string` - -The URL scheme requested by the visitor. - -## ClientRequestUserAgent - -Type: `string` - -The user-agent string of the visitor. - -## ContentScanObjResults - -Type: `array[string]` - -List of content scan results. - -## ContentScanObjSizes - -Type: `array[int]` - -List of content object sizes. - -## ContentScanObjTypes - -Type: `array[string]` - -List of content types. - -## Datetime - -Type: `int or string` - -The date and time the event occurred at the edge. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## Description - -Type: `string` - -The description of the rule triggered by this request. - -## EdgeColoCode - -Type: `string` - -The airport code of the Cloudflare data center that served this request. - -## EdgeResponseStatus - -Type: `int` - -HTTP response status code returned to the browser. - -## FirewallForAIInjectionScore (deprecated) - -Type: `int` - -The score indicating the likelihood of a prompt injection attack in the request, as determined by Firewall for AI. Deprecated: Use AISecurityInjectionScore instead. - -## FirewallForAIPIICategories (deprecated) - -Type: `array[string]` - -List of PII categories detected in the request by Firewall for AI. Deprecated: Use AISecurityPIICategories instead. - -## FirewallForAITokenCount (deprecated) - -Type: `int` - -The number of tokens in the request, as counted by Firewall for AI. Deprecated: Use AISecurityTokenCount instead. - -## FirewallForAIUnsafeTopicCategories (deprecated) - -Type: `array[string]` - -List of unsafe topic categories detected in the request by Firewall for AI. Deprecated: Use AISecurityUnsafeTopicCategories instead. - -## FraudUserID - -Type: `string` - -A unique identifier generated by the Fraud Detection system for each user, generated during any action determined by the fraud event type. - -## Kind - -Type: `string` - -The kind of event, currently only possible values are: firewall. - -## LeakedCredentialCheckResult - -Type: `string` - -Result of the check for [leaked credentials](/waf/detections/leaked-credentials/).
Possible results are: password_leaked \| username_and_password_leaked \| username_password_similar \| username_leaked \| clean. - -## MatchIndex - -Type: `int` - -Rules match index in the chain. The last matching rule will have MatchIndex 0. If another rule matched before the last one, it will have MatchIndex 1. The same applies to any other matching rules, which will have a MatchIndex value of 2, 3, and so on. - -## Metadata - -Type: `object` - -Additional product-specific information. Metadata is organized in key:value pairs. Key and Value formats can vary by Cloudflare security product and can change over time. - -## OriginResponseStatus - -Type: `int` - -HTTP origin response status code returned to the browser. - -## OriginatorRayID - -Type: `string` - -The RayID of the request that issued the challenge/jschallenge. - -## RayID - -Type: `string` - -The RayID of the request. - -## Ref - -Type: `string` - -The user-defined identifier for the rule triggered by this request. Use refs to label your rules individually alongside the Cloudflare-provided RuleID. You can set refs via the [Rulesets API](/ruleset-engine/rulesets-api/) for some security products. - -## RuleID - -Type: `string` - -The Cloudflare security product-specific RuleID triggered by this request. - -## Source - -Type: `string` - -The Cloudflare security product triggered by this request.
Possible sources are unknown \| asn \| country \| ip \| iprange \| securitylevel \| zonelockdown \| waf \| firewallrules \| uablock \| ratelimit \| bic \| hot \| l7ddos \| validation \| botfight \| apishield \| botmanagement \| dlp \| firewallmanaged \| firewallcustom \| apishieldschemavalidation \| apishieldtokenvalidation \| apishieldsequencemitigation. - -## WAFRequestSignatureCategories - -Type: `array[string]` - -List of attack signature categories matched for the request. - -## WAFRequestSignatureRefs - -Type: `array[string]` - -List of attack signature rule references (refs) matched for the request. - -## ZoneName - -Type: `string` - -The human-readable name of the zone (for example, 'cloudflare.com'). diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md deleted file mode 100644 index a5c8ce083e2..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md +++ /dev/null @@ -1,748 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: HTTP requests -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `http_requests`. - -## AISecurityCustomTopicCategories - -Type: `object` - -Customer-defined AI Security topic labels and their relevance scores. A score of 1 indicates the highest relevance, and 99 indicates the lowest relevance. - -## AISecurityInjectionScore - -Type: `int` - -The score indicating the likelihood of a prompt injection attack in the request, as determined by AI Security. - -## AISecurityPIICategories - -Type: `array[string]` - -List of PII categories detected in the request by AI Security. - -## AISecurityTokenCount - -Type: `int` - -The number of tokens in the request, as counted by AI Security. - -## AISecurityUnsafeTopicCategories - -Type: `array[string]` - -List of unsafe topic categories detected in the request by AI Security. - -## BotDetectionIDs - -Type: `array[int]` - -List of IDs that correlate to the Bot Management Heuristic detections made on a request. Available only for Bot Management customers. To enable this feature, contact your account team. - -## BotDetectionTags - -Type: `array[string]` - -List of tags that correlate to the Bot Management Heuristic detections made on a request. Available only for Bot Management customers. To enable this feature, contact your account team. - -## BotScore - -Type: `int` - -Cloudflare Bot Score. Scores below 30 are commonly associated with automated traffic. Available only for Bot Management customers. To enable this feature, contact your account team. - -## BotScoreSrc - -Type: `string` - -Detection engine responsible for generating the Bot Score.
Possible values are Not Computed \| Heuristics \| Machine Learning \| Behavioral Analysis \| Verified Bot \| JS Fingerprinting \| Cloudflare Service. Available only for Bot Management customers. To enable this feature, contact your account team. - -## BotTags - -Type: `array[string]` - -Type of bot traffic (if available). Refer to [Bot Tags](/bots/concepts/bot-tags/) for the list of potential values. Available only for Bot Management customers. To enable this feature, contact your account team. - -## CacheCacheStatus - -Type: `string` - -Cache status.
Possible values are unknown \| miss \| expired \| updating \| stale \| hit \| ignored \| bypass \| revalidated \| dynamic \| stream_hit \| deferred
"dynamic" means that a request is not eligible for cache. This can mean, for example that it was blocked by the firewall. Refer to [Cloudflare cache responses](/cache/concepts/cache-responses/) for more details. - -## CacheLockWaitedMs - -Type: `int` - -Maximum time spent waiting on a cache lock across all cache tiers, in milliseconds. - -## CacheReserveUsed - -Type: `bool` - -Cache Reserve was used to serve this request. - -## CacheResponseBytes - -Type: `int` - -Number of bytes returned by the cache. - -## CacheResponseStatus (deprecated) - -Type: `int` - -HTTP status code returned by the cache to the edge. All requests (including non-cacheable ones) go through the cache. Refer also to CacheCacheStatus field. - -## CacheTieredFill - -Type: `bool` - -Tiered Cache was used to serve this request. - -## ClientASN - -Type: `int` - -Client AS number. - -## ClientCity - -Type: `string` - -Approximate city of the client. - -## ClientCountry - -Type: `string` - -2-letter ISO-3166 country code of the client IP address. - -## ClientDeviceType - -Type: `string` - -Client device type. - -## ClientIP - -Type: `string` - -IP address of the client. - -## ClientIPClass - -Type: `string` - -Client IP class.
Possible values are unknown \| badHost \| searchEngine \| allowlist \| monitoringService \| noRecord \| scan \| tor. - -## ClientLatitude - -Type: `string` - -Approximate latitude of the client. - -## ClientLongitude - -Type: `string` - -Approximate longitude of the client. - -## ClientMTLSAuthCertFingerprint - -Type: `string` - -The SHA256 fingerprint of the certificate presented by the client during mTLS authentication. Only populated on the first request on an mTLS connection. - -## ClientMTLSAuthStatus - -Type: `string` - -The status of mTLS authentication. Only populated on the first request on an mTLS connection.
Possible values are unknown \| ok \| absent \| untrusted \| notyetvalid \| expired. - -## ClientRegionCode - -Type: `string` - -The ISO-3166-2 region code of the client IP address. - -## ClientRequestBytes - -Type: `int` - -Number of bytes in the client request. - -## ClientRequestHost - -Type: `string` - -Host requested by the client. - -## ClientRequestMethod - -Type: `string` - -HTTP method of client request. - -## ClientRequestPath - -Type: `string` - -URI path requested by the client, which includes only the path portion of the requested URL, without the query string. - -## ClientRequestProtocol - -Type: `string` - -HTTP protocol of client request. - -## ClientRequestReferer - -Type: `string` - -HTTP request referrer. - -## ClientRequestScheme - -Type: `string` - -The URL scheme requested by the visitor. - -## ClientRequestSource - -Type: `string` - -Identifies requests as coming from an external source or another service within Cloudflare. Refer to [ClientRequestSource field](/logs/reference/clientrequestsource/) for the list of potential values. - -## ClientRequestURI - -Type: `string` - -URI requested by the client, which includes the full path and query string of the requested URL. - -## ClientRequestUserAgent - -Type: `string` - -User agent reported by the client. - -## ClientSSLCipher - -Type: `string` - -Client SSL cipher. - -## ClientSSLProtocol - -Type: `string` - -Client SSL (TLS) protocol. The value "none" means that SSL was not used. - -## ClientSrcPort - -Type: `int` - -Client source port. - -## ClientTCPRTTMs - -Type: `int` - -The smoothed average of TCP round-trip time (SRTT). For the initial request on a connection, this is measured only during connection setup. For a subsequent request on the same connection, it is measured over the entire connection lifetime up until the time that request is received. - -## ClientTLSKeyExchangeGroup - -Type: `string` - -TLS key exchange group between the client and Cloudflare (for example, 'X25519MLKEM768'). 'UNK' means it could not be determined. 'NONE' means TLS was not used. - -## ClientXRequestedWith - -Type: `string` - -X-Requested-With HTTP header. - -## ContentScanObjResults - -Type: `array[string]` - -List of content scan results. - -## ContentScanObjSizes - -Type: `array[int]` - -List of content object sizes. - -## ContentScanObjTypes - -Type: `array[string]` - -List of content types. - -## Cookies - -Type: `object` - -String key-value pairs for cookies. This field is populated based on [Logpush Custom fields](/logs/logpush/logpush-job/custom-fields/), which need to be configured. - -## EdgeCFConnectingO2O - -Type: `bool` - -True if the request looped through multiple zones on the Cloudflare edge. This is considered an O2O request. - -## EdgeColoCode - -Type: `string` - -IATA airport code of the data center that received the request. - -## EdgeColoID - -Type: `int` - -Cloudflare edge data center ID. - -## EdgeEndTimestamp - -Type: `int or string` - -Timestamp at which the edge finished sending response to the client. - -## EdgePathingOp - -Type: `string` - -Indicates what type of response was issued for this request (unknown = no specific action). - -## EdgePathingSrc - -Type: `string` - -Details how the request was classified based on security checks (unknown = no specific classification). - -## EdgePathingStatus - -Type: `string` - -Indicates what data was used to determine the handling of this request (unknown = no data). - -## EdgeRequestHost - -Type: `string` - -Host header on the request from the edge to the origin. - -## EdgeResponseBodyBytes - -Type: `int` - -Size of the HTTP response body returned to clients. - -## EdgeResponseBytes - -Type: `int` - -Number of bytes returned by the edge to the client. - -## EdgeResponseCompressionRatio - -Type: `float` - -The edge response compression ratio is calculated as the ratio between the sizes of the original and compressed responses. - -## EdgeResponseContentType - -Type: `string` - -Edge response Content-Type header value. - -## EdgeResponseStatus - -Type: `int` - -HTTP status code returned by Cloudflare to the client. - -## EdgeServerIP - -Type: `string` - -IP of the edge server making a request to the origin. Possible responses are string in IPv4 or IPv6 format, or empty string. Empty string means that there was no request made to the origin server. - -## EdgeStartTimestamp - -Type: `int or string` - -Timestamp at which the edge received request from the client. - -## EdgeTimeToFirstByteMs - -Type: `int` - -Total view of Time To First Byte as measured at Cloudflare's edge. Starts after a TCP connection is established and ends when Cloudflare begins returning the first byte of a response to eyeballs. Includes TLS handshake time (for new connections) and origin response time. - -## FirewallForAIInjectionScore (deprecated) - -Type: `int` - -The score indicating the likelihood of a prompt injection attack in the request, as determined by Firewall for AI. Deprecated: Use AISecurityInjectionScore instead. - -## FirewallForAIPIICategories (deprecated) - -Type: `array[string]` - -List of PII categories detected in the request by Firewall for AI. Deprecated: Use AISecurityPIICategories instead. - -## FirewallForAITokenCount (deprecated) - -Type: `int` - -The number of tokens in the request, as counted by Firewall for AI. Deprecated: Use AISecurityTokenCount instead. - -## FirewallForAIUnsafeTopicCategories (deprecated) - -Type: `array[string]` - -List of unsafe topic categories detected in the request by Firewall for AI. Deprecated: Use AISecurityUnsafeTopicCategories instead. - -## FraudAttack - -Type: `string` - -The primary attack or use case detected in the request by Fraud detections. - -## FraudDetectionIDs - -Type: `array[int]` - -List of IDs that correlate to the Fraud detections made on a request. - -## FraudDetectionTags - -Type: `array[string]` - -List of tags that correlate to the Fraud detections made on a request. - -## FraudEmailRisk - -Type: `string` - -Risk of a specific email address.
Possible values are low \| medium \| high. - -## FraudUserID - -Type: `string` - -A unique identifier generated by the Fraud Detection system for each user, generated during any action determined by the fraud event type. - -## JA3Hash - -Type: `string` - -The MD5 hash of the JA3 fingerprint used to profile SSL/TLS clients. Available only for Bot Management customers. To enable this feature, contact your account team. - -## JA4 - -Type: `string` - -The JA4 fingerprint used to profile SSL/TLS clients. Available only for Bot Management customers. To enable this feature, contact your account team. - -## JA4Signals - -Type: `object` - -Inter-request statistics computed for this JA4 fingerprint. JA4Signals field is organized in key:value pairs, where values are numbers. Available only for Bot Management customers. To enable this feature, contact your account team. - -## JSDetectionPassed - -Type: `string` - -Whether the request passed background JavaScript Detection.
Possible values are passed \| failed \| missing. Available only for Bot Management customers. To enable this feature, contact your account team. - -## LeakedCredentialCheckResult - -Type: `string` - -Result of the check for [leaked credentials](/waf/detections/leaked-credentials/).
Possible results are: password_leaked \| username_and_password_leaked \| username_password_similar \| username_leaked \| clean. - -## MatchedRules - -Type: `array[object]` - -Array of matched Cloudflare Rules product rules grouped by product. Each object contains: product (string, for example snippets, transform, redirects), rulesetId (string), rulesetVersion (int), and rules (array of objects, each with id (string) and optional metadata (object with string key-value pairs)). - -## OriginDNSResponseTimeMs - -Type: `int` - -Time taken to receive a DNS response for an origin name. Usually takes a few milliseconds, but may be longer if a CNAME record is used. - -## OriginIP - -Type: `string` - -IP of the origin server. - -## OriginRequestHeaderSendDurationMs - -Type: `int` - -Time taken to send request headers to origin after establishing a connection. Note that this value is usually 0. - -## OriginResponseBytes (deprecated) - -Type: `int` - -Number of bytes returned by the origin server. Consider using CacheResponseBytes and filtering out OriginResponseStatus with values 0 and 304, which indicate a revalidated response. Refer to [Calculating origin-served bytes](/logs/faq/common-calculations/#how-can-i-calculate-bytes-served-by-the-origin-from-cloudflare-logs). - -## OriginResponseDurationMs - -Type: `int` - -Upstream response time, measured from the first datacenter that receives a request. Includes time taken by Argo Smart Routing and Tiered Cache, plus time to connect and receive a response from origin servers. This field replaces OriginResponseTime. - -## OriginResponseHTTPExpires - -Type: `string` - -Value of the origin 'expires' header in RFC1123 format. - -## OriginResponseHTTPLastModified - -Type: `string` - -Value of the origin 'last-modified' header in RFC1123 format. - -## OriginResponseHeaderReceiveDurationMs - -Type: `int` - -Time taken for origin to return response headers after Cloudflare finishes sending request headers. - -## OriginResponseStatus - -Type: `int` - -Status returned by the upstream server. The value 0 means that there was no response received from the origin server and the response was served by Cloudflare's Edge. However, if the zone has a Worker running on it, the value 0 could be the result of a Workers subrequest made to the origin. - -## OriginResponseTime (deprecated) - -Type: `int` - -Number of nanoseconds it took the origin to return the response to edge. - -## OriginSSLProtocol - -Type: `string` - -SSL (TLS) protocol used to connect to the origin. - -## OriginTCPHandshakeDurationMs - -Type: `int` - -Time taken to complete TCP handshake with origin. This will be 0 if an origin connection is reused. - -## OriginTLSHandshakeDurationMs - -Type: `int` - -Time taken to complete TLS handshake with origin. This will be 0 if an origin connection is reused. - -## ParentRayID - -Type: `string` - -Ray ID of the parent request if this request was made using a Worker script. - -## PayPerCrawlStatus - -Type: `string` - -Pay Per Crawl outcome, when applicable (for example, request enabled for charging and not blocked by a WAF rule). - -## RayID - -Type: `string` - -ID of the request. - -## RequestHeaders - -Type: `object` - -String key-value pairs for request headers. This field is populated based on [Logpush Custom fields](/logs/logpush/logpush-job/custom-fields/), which need to be configured. - -## ResponseHeaders - -Type: `object` - -String key-value pairs for response headers. This field is populated based on [Logpush Custom fields](/logs/logpush/logpush-job/custom-fields/), which need to be configured. - -## SecurityAction - -Type: `string` - -Action of the security rule that triggered a terminating action, if any. - -## SecurityActions - -Type: `array[string]` - -Array of actions the Cloudflare security products performed on this request. The individual security products associated with this action can be found in SecuritySources and their respective rule IDs can be found in SecurityRuleIDs. The length of the array is the same as SecurityRuleIDs and SecuritySources.
Possible actions are unknown \| allow \| block \| challenge \| jschallenge \| log \| connectionClose \| challengeSolved \| challengeBypassed \| jschallengeSolved \| jschallengeBypassed \| bypass \| managedChallenge \| managedChallengeNonInteractiveSolved \| managedChallengeInteractiveSolved \| managedChallengeBypassed \| rewrite \| forceConnectionClose \| skip \| precursorInterstitialPageIssued \| precursorInterstitialPageBypassed \| precursorInterstitialPageSolved. - -## SecurityRuleDescription - -Type: `string` - -Description of the security rule that triggered a terminating action, if any. - -## SecurityRuleID - -Type: `string` - -Rule ID of the security rule that triggered a terminating action, if any. - -## SecurityRuleIDs - -Type: `array[string]` - -Array of rule IDs of the security product that matched the request. The security product associated with the rule ID can be found in SecuritySources. The length of the array is the same as SecurityActions and SecuritySources. - -## SecuritySources - -Type: `array[string]` - -Array of security products that matched the request. The same product can appear multiple times, which indicates different rules or actions that were activated. The rule IDs can be found in SecurityRuleIDs, and the actions can be found in SecurityActions. The length of the array is the same as SecurityRuleIDs and SecurityActions.
Possible sources are unknown \| asn \| country \| ip \| ipRange \| securityLevel \| zoneLockdown \| waf \| firewallRules \| uaBlock \| rateLimit \| bic \| hot \| l7ddos \| validation \| botFight \| apiShield \| botManagement \| dlp \| firewallManaged \| firewallCustom \| apiShieldSchemaValidation \| apiShieldTokenValidation \| apiShieldSequenceMitigation \| precursor. - -## SmartRouteColoID - -Type: `int` - -The Cloudflare data center used to connect to the origin server if Argo Smart Routing is used. - -## Subrequests - -Type: `array[object]` - -Flattened list of subrequests associated with this request. Each subrequest contains the same fields as the parent request (excluding Subrequests itself). - -## UpperTierColoID - -Type: `int` - -The "upper tier" data center that was checked for a cached copy if Tiered Cache is used. - -## VerifiedBotCategory - -Type: `string` - -The category of verified bot. - -## WAFAttackScore - -Type: `int` - -Overall request score generated by the WAF detection module. - -## WAFFlags (deprecated) - -Type: `string` - -Additional configuration flags: simulate (0x1) \| null. - -## WAFMatchedVar (deprecated) - -Type: `string` - -The full name of the most-recently matched variable. - -## WAFRCEAttackScore - -Type: `int` - -WAF score for an RCE attack. - -## WAFRequestSignatureCategories - -Type: `array[string]` - -List of attack signature categories matched for the request. - -## WAFRequestSignatureRefs - -Type: `array[string]` - -List of attack signature rule references (refs) matched for the request. - -## WAFSQLiAttackScore - -Type: `int` - -WAF score for an SQLi attack. - -## WAFXSSAttackScore - -Type: `int` - -WAF score for an XSS attack. - -## WebAssetsLabelsManaged - -Type: `array[string]` - -Cloudflare-defined labels matched for the request. - -## WebAssetsOperationID - -Type: `string` - -UUID of the matched web asset operation. - -## WorkerCPUTime - -Type: `int` - -Amount of time in microseconds spent executing a Worker, if any. - -## WorkerScriptName - -Type: `string` - -The Worker script name that made the request. - -## WorkerStatus - -Type: `string` - -Status returned from Worker daemon. - -## WorkerSubrequest - -Type: `bool` - -Whether or not this request was a Worker subrequest. - -## WorkerSubrequestCount - -Type: `int` - -Number of subrequests issued by a Worker when handling this request. - -## WorkerWallTimeUs - -Type: `int` - -The elapsed time in microseconds between the start of a Worker invocation, and when the Workers Runtime determines that no more JavaScript needs to run. Specifically, this measures the wall-clock time that the JavaScript context remained open. For example, when returning a response with a large body, the Workers runtime can, in some cases, determine that no more JavaScript needs to run, and closes the JS context before all the bytes have passed through and been sent. Alternatively, if you use the `waitUntil()` API to perform work without blocking the return of a response, this work may continue executing after the response has been returned, and will be included in `WorkerWallTimeUs`. - -## ZoneName - -Type: `string` - -The human-readable name of the zone (for example, 'cloudflare.com'). diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/nel_reports.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/nel_reports.md deleted file mode 100644 index 624aacd917f..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/nel_reports.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: NEL reports -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `nel_reports`. - -## ClientIPASN - -Type: `int` - -Client ASN. - -## ClientIPASNDescription - -Type: `string` - -Client ASN description. - -## ClientIPCountry - -Type: `string` - -Client country. - -## LastKnownGoodColoCode - -Type: `string` - -IATA airport code of colo client connected to. - -## Phase - -Type: `string` - -The phase of connection the error occurred in; dns \| connection \| application \| unknown. - -## Timestamp - -Type: `int or string` - -Timestamp for error report. - -## Type - -Type: `string` - -The type of error in the phase. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/page_shield_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/page_shield_events.md deleted file mode 100644 index 7659c1454a3..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/page_shield_events.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Page Shield events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `page_shield_events`. - -## Action - -Type: `string` - -The action which was taken against the violation.
Possible values are log \| allow. - -## CSPDirective - -Type: `string` - -The violated directive in the report. - -## Host - -Type: `string` - -The host where the resource was seen on. - -## PageURL - -Type: `string` - -The page URL the violation was seen on. - -## PolicyID - -Type: `string` - -The ID of the policy which was violated. - -## ResourceType - -Type: `string` - -The resource type of the violated directive. Possible values are 'script', 'connection', or 'other' for unmonitored resource types. - -## Timestamp - -Type: `int or string` - -The timestamp of when the report was received. - -## URL - -Type: `string` - -The resource URL. - -## URLContainsCDNCGIPath (deprecated) - -Type: `bool` - -Whether the resource URL contains the '/cdn-cgi/' path. - -## URLHost - -Type: `string` - -The domain host of the URL. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/spectrum_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/spectrum_events.md deleted file mode 100644 index bc218707b16..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/spectrum_events.md +++ /dev/null @@ -1,196 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Spectrum events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `spectrum_events`. - -## Application - -Type: `string` - -The unique public ID of the application on which the event occurred. - -## ClientAsn - -Type: `int` - -Client AS number. - -## ClientBytes - -Type: `int` - -The number of bytes read from the client by the Spectrum service. - -## ClientCountry - -Type: `string` - -Country of the client IP address. - -## ClientIP - -Type: `string` - -Client IP address. - -## ClientMatchedIpFirewall - -Type: `string` - -Whether the connection matched any IP Firewall rules. UNKNOWN = No match or Firewall not enabled for Spectrum; UNKNOWN \| ALLOW \| BLOCK_ERROR \| BLOCK_IP \| BLOCK_COUNTRY \| BLOCK_ASN \| WHITELIST_IP \| WHITELIST_COUNTRY \| WHITELIST_ASN. - -## ClientPort - -Type: `int` - -Client port. - -## ClientProto - -Type: `string` - -Transport protocol used by client; tcp \| udp \| unix. - -## ClientTcpRtt - -Type: `int` - -The TCP round-trip time in nanoseconds between the client and Spectrum. - -## ClientTlsCipher - -Type: `string` - -The cipher negotiated between the client and Spectrum. An unknown cipher is returned as "UNK." - -## ClientTlsClientHelloServerName - -Type: `string` - -The server name in the Client Hello message from client to Spectrum. - -## ClientTlsProtocol - -Type: `string` - -The TLS version negotiated between the client and Spectrum; unknown \| none \| SSLv3 \| TLSv1 \| TLSv1.1 \| TLSv1.2 \| TLSv1.3. - -## ClientTlsStatus - -Type: `string` - -Indicates state of TLS session from the client to Spectrum; UNKNOWN \| OK \| INTERNAL_ERROR \| INVALID_CONFIG \| INVALID_SNI \| HANDSHAKE_FAILED \| KEYLESS_RPC. - -## ColoCode - -Type: `string` - -IATA airport code of the data center that received the request. - -## ConnectTimestamp - -Type: `int or string` - -Timestamp at which both legs of the connection (client/edge, edge/origin or nexthop) were established. - -## DisconnectTimestamp - -Type: `int or string` - -Timestamp at which the connection was closed. - -## Event - -Type: `string` - -connect \| disconnect \| clientFiltered \| tlsError \| resolveOrigin \| originError. - -## IpFirewall - -Type: `bool` - -Whether IP Firewall was enabled at time of connection. - -## OriginBytes - -Type: `int` - -The number of bytes read from the origin by Spectrum. - -## OriginIP - -Type: `string` - -Origin IP address. - -## OriginPort - -Type: `int` - -Origin port. - -## OriginProto - -Type: `string` - -Transport protocol used by origin; tcp \| udp \| unix. - -## OriginTcpRtt - -Type: `int` - -The TCP round-trip time in nanoseconds between Spectrum and the origin. - -## OriginTlsCipher - -Type: `string` - -The cipher negotiated between Spectrum and the origin. An unknown cipher is returned as "UNK." - -## OriginTlsFingerprint - -Type: `string` - -SHA256 hash of origin certificate. An unknown SHA256 hash is returned as an empty string. - -## OriginTlsMode - -Type: `string` - -If and how the upstream connection is encrypted; unknown \| off \| flexible \| full \| strict. - -## OriginTlsProtocol - -Type: `string` - -The TLS version negotiated between Spectrum and the origin; unknown \| none \| SSLv3 \| TLSv1 \| TLSv1.1 \| TLSv1.2 \| TLSv1.3. - -## OriginTlsStatus - -Type: `string` - -The state of the TLS session from Spectrum to the origin; UNKNOWN \| OK \| INTERNAL_ERROR \| INVALID_CONFIG \| INVALID_SNI \| HANDSHAKE_FAILED \| KEYLESS_RPC. - -## ProxyProtocol - -Type: `string` - -Which form of proxy protocol is applied to the given connection; off \| v1 \| v2 \| simple. - -## Status - -Type: `int` - -A code indicating reason for connection closure. - -## Timestamp - -Type: `int or string` - -Timestamp at which the event took place. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/websocket_analytics.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/websocket_analytics.md deleted file mode 100644 index 5a7d728be5b..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/websocket_analytics.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: WebSocket Analytics -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `websocket_analytics`. - -## BytesReceivedClient - -Type: `int` - -Number of bytes received from the client. - -## BytesReceivedOrigin - -Type: `int` - -Number of bytes received from the origin. - -## BytesSentClient - -Type: `int` - -Number of bytes sent to the client. - -## BytesSentOrigin - -Type: `int` - -Number of bytes sent to the origin. - -## ClientASN - -Type: `int` - -The client's autonomous system number (ASN). - -## ClientIP - -Type: `string` - -The client IP address. - -## ClientRequestHost - -Type: `string` - -The host requested by the client in the WebSocket upgrade request. - -## ClientRequestPath - -Type: `string` - -The path requested by the client in the WebSocket upgrade request. - -## ClientRequestUserAgent - -Type: `string` - -The user agent reported by the client. - -## ColoCode - -Type: `string` - -IATA airport code of the data center that handled the connection. - -## ConnectionCloseReason - -Type: `string` - -The reason the WebSocket connection ended.
Possible values are none \| unspecifiedError \| timedOut \| peerReset \| upstreamReset \| protocolViolation \| peerNoError. - -## ConnectionCloseSource - -Type: `string` - -Which side initiated the connection close.
Possible values are upstream \| downstream \| me \| both, or the raw internal value if unrecognized. - -## ConnectionID - -Type: `string` - -Unique identifier of the WebSocket connection, hex-encoded. - -## ConnectionTransportCloseCode - -Type: `int` - -The first transport-level close code observed. For TLS connections this is the TLS alert code; for plain TCP connections (no TLS) it is always 0. The most significant bit indicates the source: 0 = proxy-initiated, 1 = eyeball-initiated. - -## EdgeEndTimestamp - -Type: `int or string` - -Timestamp at which the WebSocket connection closed. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## EdgeStartTimestamp - -Type: `int or string` - -Timestamp at which the WebSocket connection was established. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types). - -## RayID - -Type: `string` - -The Ray ID of the WebSocket upgrade request. diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/zaraz_events.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/zaraz_events.md deleted file mode 100644 index c1f33e1edb6..00000000000 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/zaraz_events.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -# Code generator. DO NOT EDIT. - -title: Zaraz Events -pcx_content_type: configuration -sidebar: - order: 21 ---- - -The descriptions below detail the fields available for `zaraz_events`. - -## Body - -Type: `object` - -Zaraz incoming request body. - -## EventDetails - -Type: `object` - -Zaraz log event details. - -## EventType - -Type: `string` - -Zaraz log event name. - -## IP - -Type: `string` - -Zaraz incoming request client IP address. - -## RequestHeaders - -Type: `object` - -Zaraz incoming request headers. - -## TimestampStart - -Type: `int or string` - -Zaraz log event timestamp. - -## URL - -Type: `string` - -Zaraz incoming request URL. From b00615aef6c38c0e736f70e7e675462cb42d121e Mon Sep 17 00:00:00 2001 From: mvm Date: Fri, 11 Sep 2026 18:20:30 -0500 Subject: [PATCH 2/3] fix: re-download Logpush dataset archive on --force, generalize gitignore --- .gitignore | 3 +-- bin/fetch-logpush-datasets.ts | 13 ++++++++++--- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 774a86df5eb..e9feb2740ae 100644 --- a/.gitignore +++ b/.gitignore @@ -15,8 +15,7 @@ skills/ !.flue/.agents/** # Logpush dataset pages are fetched from middlecache via bin/fetch-logpush-datasets.ts -src/content/docs/logs/logpush/logpush-job/datasets/zone/*.md -src/content/docs/logs/logpush/logpush-job/datasets/account/*.md +src/content/docs/logs/logpush/logpush-job/datasets/*/*.md # dependencies node_modules/ diff --git a/bin/fetch-logpush-datasets.ts b/bin/fetch-logpush-datasets.ts index 3843a4fb72c..12ee58c55cb 100644 --- a/bin/fetch-logpush-datasets.ts +++ b/bin/fetch-logpush-datasets.ts @@ -20,7 +20,8 @@ const EXTRACTED_DIR = join(".tmp", "logpush-datasets-extracted"); // --soft: warn and continue on failure instead of exiting non-zero. // Used by the predev hook so a network failure doesn't block local development. -// --force: re-fetch even if the generated dataset pages already exist. +// --force: re-fetch even if the generated dataset pages exist, including a +// fresh download of the archive from middlecache. const soft = process.argv.includes("--soft"); const force = process.argv.includes("--force"); @@ -72,6 +73,14 @@ if (hasGeneratedPages && !force) { process.exit(0); } +const archivePath = join(".tmp", ...ARCHIVE_DOT_TMP_PATH.split("/")); + +if (force) { + // --force means re-fetch from middlecache: drop the cached archive so + // downloadToDotTempIfNotPresent actually downloads rather than reusing it. + fs.rmSync(archivePath, { force: true }); +} + console.log("Fetching Logpush dataset pages from middlecache"); try { @@ -83,8 +92,6 @@ try { fail(`fetch failed: ${err}`); } -const archivePath = join(".tmp", ...ARCHIVE_DOT_TMP_PATH.split("/")); - // Remove any stale extracted content so we never sync pages from an old run. fs.rmSync(EXTRACTED_DIR, { recursive: true, force: true }); From d16f2feb0751df72a02363fec107534c52554737 Mon Sep 17 00:00:00 2001 From: mvm Date: Fri, 11 Sep 2026 18:31:59 -0500 Subject: [PATCH 3/3] fix: resolve Logpush archive cache path via getDotTmpPath --- bin/fetch-logpush-datasets.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bin/fetch-logpush-datasets.ts b/bin/fetch-logpush-datasets.ts index 12ee58c55cb..57c5237579c 100644 --- a/bin/fetch-logpush-datasets.ts +++ b/bin/fetch-logpush-datasets.ts @@ -8,6 +8,7 @@ import YAML from "yaml"; import { downloadToDotTempIfNotPresent, extractTarGz, + getDotTmpPath, } from "../src/util/custom-loaders"; const MIDDLECACHE_BASE_URL = `${( @@ -73,7 +74,10 @@ if (hasGeneratedPages && !force) { process.exit(0); } -const archivePath = join(".tmp", ...ARCHIVE_DOT_TMP_PATH.split("/")); +// Resolve the cache path the same way downloadToDotTempIfNotPresent does +// (repo-root `.tmp`, not cwd-relative) so the --force eviction always targets +// the file the downloader will reuse. +const archivePath = join(getDotTmpPath(), ...ARCHIVE_DOT_TMP_PATH.split("/")); if (force) { // --force means re-fetch from middlecache: drop the cached archive so