Investigating multi-vector attacks in Log Explorer

This article explains how Cloudflare's Log Explorer helps security teams investigate multi-vector attacks through correlated telemetry across 14+ log datasets.

• •Log Explorer integrates 14 new datasets covering HTTP Requests, Firewall Events, DNS logs, Zero Trust Access, and Network Analytics for 360-degree visibility.
• •Correlating application-layer, network-layer, and Zero Trust telemetry allows security analysts to reduce Mean Time to Detect (MTTD) against sophisticated, multi-layered attacks.
• •Zone-Scoped logs cover public-facing traffic (HTTP, Firewall, DNS, Spectrum, Page Shield, Zaraz), while Account-Scoped logs cover internal security (Access, Audit, CASB, Gateway, Magic IDS, WARP).
• •Attackers can be tracked across stages: reconnaissance via 401/403/404 scan patterns, diversionary DDoS floods in network_analytics_logs, payload delivery via WAFAttackScore fields, and credential abuse in access_requests.