cloudflare-http-requests
Get HTTP requests from Cloudflare service (Logpull API)
Syntax
cloudflare-http-requests [profile=PROFILE] from=yyyyMMddHHmmss [to=yyyyMMddHHmmss]
Options
- profile=PROFILE
- Optional. Connect profile code of Cloudflare
- from=yyyyMMddHHmmss
- Required. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| src_ip | IP address | Source IP | |
| status | Integer | Status | e.g. 200, 403, 404, 500 |
| method | String | HTTP Method | e.g. GET, POST |
| path | String | Path | |
| user_agent | String | User agent | |
| start_time | Date | Start time | |
| end_time | Date | End time | |
| host | String | Host ID | |
| http_ver | String | HTTP Version | |
| src_port | Integer | Source port | |
| src_asn | Integer | Source Autonomous System Number | |
| src_country | String | Source country | |
| sent_bytes | Integer | Sent bytes | |
| recv_bytes | Integer | Received bytes | |
| tls_ver | String | TLS Version | |
| tls_cipher | String | SSL Cipher | |
| request_headers | Map | ||
| response_headers | Map | ||
| cookies | Map | ||
| ray_id | String | Ray ID | |
| edge_server_ip | IP address | Edge Server IP | |
| origin_ip | IP address | Original IP | |
| src_device | String | Source Device | |
| uri | String | URI | |
| x_requested_with | String | ||
| origin_status | Integer | Origin status | origin response status. 0 = served by edge |
| src_ip_class | String | Source IP class | IP reputation e.g. noRecord/tor/scan/badHost |
| sec_action | String | Security action | terminating action e.g. block/challenge |
| sec_actions | List | Security actions | actions taken (array) |
| sec_sources | List | Security sources | matched products (array) e.g. waf/firewallRules/botManagement |
| sec_rule_id | String | Security rule ID | |
| attack_score | Integer | WAF attack score | lower = more likely attack |
| sqli_score | Integer | WAF SQLi score | |
| xss_score | Integer | WAF XSS score | |
| rce_score | Integer | WAF RCE score | |
| bot_score | Integer | Bot score | below 30 = likely automated |
| mtls_status | String | mTLS status |