Investigating multi-vector attacks in Log Explorer

This post introduces the expansion of Cloudflare Log Explorer to include 14 new datasets, covering the full surface of Cloudflare's Application Services and Cloudflare One product portfolios. It details how correlating telemetry from application-layer HTTP requests, network-layer DDoS and Firewall logs, and Zero Trust Access events allows security analysts to reduce Mean Time to Detect (MTTD) and unmask sophisticated, multi-layered attacks. Specific examples are provided for identifying reconnaissance (e.g., querying http_requests for specific status codes and paths, or magic_ids_detections for scans), diversions (network_analytics_logs for volumetric attacks), approaches (http_requests and fw_events for malicious payloads), auditing identity (access_requests), and stopping data exfiltration (DNS tunneling via QueryName and QueryType in DNS logs, or protocol anomalies in magic_ids_detections). The post also highlights the new Tabs feature for working with multiple queries simultaneously and pivoting between them.