Investigating Multi-Vector Attacks in Log Explorer

Cloudflare Log Explorer adds 14 new datasets, bringing together telemetry from across Application Services and Cloudflare One in one place. By cross-analyzing HTTP Requests, Firewall Events, DNS, Access, Gateway, Magic IDS, and more, you can trace a single flow from reconnaissance, diversion, and exploit attempts to identity theft and exfiltration.

Zone-scoped logs cover web traffic and edge security events, while account-scoped logs cover internal security, Zero Trust, administrative changes, and network activity. In particular, by looking at EdgeResponseStatus 401/403/404 on HTTP Requests, access to sensitive paths, multi-port scans from Magic IDS, and large-scale floods from network_analytics_logs together, you can identify what an attacker scanned and what they used as a diversion before launching a full-scale intrusion.

The response workflow is also concrete.

• Reconnaissance: Look for 401/403/404 or paths like /.env, /.git, /wp-admin in http_requests, and check magic_ids_detections for signs of port scans and SYN stealth scans.
• Diversion: Use network_analytics_logs to check whether a large-scale volumetric attack occurred at the same time.
• Approach: In http_requests and fw_events, check for malicious payloads and whether they were blocked via WAFAttackScore, WAFSQLiAttackScore, FraudAttack, ContentScanJobResults, action, source, and ruleID.
• Identity: In access_requests, check ClientIP and Decision: Allow to trace whether a suspicious IP accessed internal apps.
• Exfiltration: In gateway_dns, look for long, high-entropy subdomains and TXT/CNAME/NULL patterns to suspect DNS tunneling, and check magic_ids_detections for ICMP tunneling and DNS tunneling signatures.

On top of this, the Tabs feature lets you run multiple queries at once and pivot and filter results, allowing you to quickly connect interrelated incidents. For example, you can link a low BotScore session from http_requests to a RayID in access_requests, or find a phishing alert in email_security_alerts and then follow it through access_requests and gateway_dns to trace internal infection and C2 beaconing.

The key point is that Log Explorer is not a single log viewer, but a forensic tool for cross-correlating signals collected at the Cloudflare edge. It's also designed so that log schemas are defined via JSON Schema, allowing continued expansion with new telemetry, and to accept structured JSON data even from outside Cloudflare.