Available Notifications
Available Notifications depend on your Cloudflare plan. Cloudflare offers a variety of Notifications for our products and services, such as Billing, Denial of Service protection, Magic Transit, and SSL/TLS.
Depending on your plan, you can also configure webhooks, allowing you to connect your account with external services such as Slack and Google Chat, and PagerDuty to receive Cloudflare Notifications.
Each Notification carries different types of information about the status of your Cloudflare account, or the type of action you can take.
Refer to information below to understand what each Notification does and what to do when receiving one.
Usage Based Billing
Who is it for?Customers who want to receive a notification when the usage of a product goes above a set level.
Other options / filtersYou can choose the product that you want to be notified about and the threshold that fires the notification. Thresholds depend on the product chosen.
For example:
- Argo Smart Routing has Notify when total bytes of traffic exceeds as a threshold.
- Load Balancing has Notify when total number of DNS Queries exceeds as a threshold.
Professional plans or higher.
What should you do if you receive one?Review your product usage and adjust the configuration and/or increase the alerting threshold.
Expiring Access Service Token Alert
Who is it for?Access customers who want to receive a notification when their service token is about to expire.
Other options / filtersNone.
Included withPurchase of Access
What should you do if you receive one?Refresh your service token in the Teams dashboard under Configuration > Service Auth.
Maintenance Notification
Who is it for?Customers interested in knowing about planned Cloudflare maintenance for specific data centers. The notification lets you know when maintenance has been scheduled, changed, or canceled on an entire point of presence.
Other options / filtersYou can filter maintenance notifications for specific points of presence and updates (scheduled, changed, canceled).
Included withAll Cloudflare plans.
What should you do if you receive one?If the notification is announcing new scheduled maintenance, you may want to add the maintenance to your calendar. During these maintenance windows, you may experience a slight increase in latency to the edge location which is under maintenance.
Incident Alerts
Who is it for?Customers interested in knowing about Cloudflare incidents. The notification lets you know when Cloudflare incidents are created, updated, and resolved.
Other options / filtersYou can filter incident alerts to specific impact levels (minor, major, critical).
Additionally, incident alerts can be filtered to incidents affecting specific components. By default, incident alerts will trigger a notification for incident updates across all impact levels and components.
The impact level and affected components of an incident may change as the incident progresses. A notification will only be sent if the configured filters match at the time of the incident update. Updates will not be sent retroactively.
Included withAll Cloudflare plans.
What should you do if you receive one?Review your analytics page to see if your domain is impacted.
HTTP DDoS Attack Alert
Who is it for?WAF or CDN customers who want to receive a notification when Cloudflare has mitigated HTTP attacks that generate more than 100 requests per second.
Other options / filtersNone.
Included withAll Cloudflare plans.
What should you do if you receive one?No action needed. Refer to DDoS alerts for more information.
Layer 3/4 DDoS Attack Alert
Who is it for?BYOIP and Spectrum customers with Network Analytics who want to receive a notification when Cloudflare has mitigated attacks that generate an average of at least 12,000 packets per second over a five-second period, with a duration of one minute or more.
Other options / filtersNone.
Included withPurchase of Magic Transit and/or BYOIP.
What should you do if you receive one?No action needed. Refer to DDoS alerts for more information.
Advanced HTTP DDoS Attack Alert
Who is it for?WAF or CDN customers with the Advanced DDoS Protection subscription who want to receive a notification when Cloudflare has mitigated attacks that generate more than the configured number of requests per second (100 rps by default).
Other options / filtersYou can choose when to trigger a notification.
Available filters include:
- The zones in the account for which you wish to receive notifications.
- The specific hostnames for which you wish to receive notifications.
- The minimum requests-per-second rate that will trigger the alert (100 rps by default).
Enterprise plans.
What should you do if you receive one?No action needed. Refer to DDoS alerts for more information.
Advanced Layer 3/4 DDoS Attack Alert
Who is it for?BYOIP and Magic Transit customers with Network Analytics who want to receive a notification when Cloudflare has mitigated attacks that generate more than the configured number of packets per second (12,000 pps by default).
Other options / filtersYou can choose when to trigger a notification.
Available filters include:
- The IP prefixes for which you wish to receive notifications.
- The specific IP addresses for which you wish to receive notifications.
- The minimum packets-per-second rate that will trigger the alert (12,000 pps by default).
- The minimum megabits-per-second rate that will trigger the alert.
- The protocols for which you wish to receive notifications (all protocols by default).
Purchase of Magic Transit and/or BYOIP (Enterprise plans).
What should you do if you receive one?No action needed. Refer to DDoS alerts for more information.
Device connectivity anomaly
Who is it for?Zero Trust customers who want to be notified when Cloudflare detects a spike or drop in the number of devices connected to the WARP client.
Other options / filters- Alert configuration: Choose when to trigger a notification. Available options are Connectivity spike, Connectivity drop, and Connectivity spike or drop.
- Filters:
- Colo: Cloudflare data center that the device is connected to.
- Platform: Operating system of the device.
- Version: WARP client version (for example,
2024.3.409.0). - Mode: WARP mode deployed on the device.
All Cloudflare Zero Trust plans.
What should you do if you receive one?Review your fleet status to investigate why the spike or drop occurred and which devices are impacted.
Additional informationTo learn more about the alert logic, refer to Z-score.
DEX test latency
Who is it for?Zero Trust customers who wish to receive alerts when there is a spike or drop in application latency, as measured by the HTTP test Resource Fetch time or Traceroute test Round trip time. Requires setting up a DEX test.
Other options / filters- Alert configuration: Choose when to trigger a notification. Available options are Latency spike, Latency drop, and Latency spike or drop.
- Filters:
- Colo: Cloudflare data center that the device is connected to.
- Platform: Operating system of the device.
- Version: WARP client version (for example,
2024.3.409.0). - Test name: Choose which DEX test the alert should monitor. You will receive individual notifications for each test.
All Cloudflare Zero Trust plans.
What should you do if you receive one?View your test results to investigate why the spike occurred.
Additional informationTo learn more about the alert logic, refer to Z-score.
DEX test low availability
Who is it for?Zero Trust customers who wish to receive alerts when the percentage of successful HTTP or traceroute requests to an application drops below the selected service-level objective (SLO). Requires setting up a DEX test.
Other options / filters- Service Level Objective (SLO): Specify the availability threshold that will trigger an alert. Enter a percentage in
xx.xformat (for example,98.0). - Filters:
- Colo: Cloudflare data center that the device is connected to.
- Platform: Operating system of the device.
- Version: WARP client version (for example,
2024.3.409.0). - Test name: Choose which DEX test the alert should monitor. You will receive individual notifications for each test.
All Cloudflare Zero Trust plans.
What should you do if you receive one?View your test results to investigate why the degradation occurred.
Additional informationTo learn more about the alert logic, refer to SLO.
Secondary DNS all Primaries Failing
Who is it for?Enterprise customers who have at least one secondary zone in their account and want to receive a notification if all of their primary nameservers are failing.
Other options / filtersNone.
Included withPurchase of Secondary DNS
What should you do if you receive one?- Confirm that your primary nameservers are up and running.
- Confirm that the Access Control Lists (ACLs) on your primary nameservers are configured correctly.
- Confirm that your primary nameservers are configured correctly in your Cloudflare account (correct IP, port, TSIG).
Secondary DNS Primaries Failing
Who is it for?Enterprise customers who have at least one secondary zone and want to receive a notification if at least one of their primary nameservers is failing.
Other options / filtersNone.
Included withPurchase of Secondary DNS.
What should you do if you receive one?- Confirm that your primary nameservers are up and running.
- Confirm that the Access Control Lists (ACLs) on your primary nameservers are configured correctly.
- Confirm that your primary nameservers are configured correctly in your Cloudflare account (correct IP, port, TSIG).
Secondary DNS Successfully Updated
Who is it for?Enterprise customers who have at least one secondary zone in their account and want to receive a notification on successful zone transfers.
Other options / filtersNone.
Included withPurchase of Secondary DNS.
What should you do if you receive one?No action needed. Everything is working correctly.
Secondary DNSSEC Validation Warning
Who is it for?Customers who are using Cloudflare for Secondary DNS and want to receive notifications about the failure or success of zone transfers from their primary nameservers.
Other options / filtersNone.
Included withEnterprise plans.
What should you do if you receive one?Success alerts require no further action. Actions for failure notifications will depend on the type of failure.
Possible actions include:
- Checking the Access Control List (ACL) on your primary nameserver.
- Checking if Cloudflare IPs have been configured correctly on your primary nameserver.
- Checking logs on primary nameservers for other errors.
Health Checks status notification
Who is it for?Customers who want to be warned about changes to server health as determined by health checks.
Other options / filtersAvailable filters include:
- You can search for and add health checks from your list of health checks.
- You can choose a trigger to fire the notification when your server becomes unhealthy, healthy, or either healthy or unhealthy.
Professional plans or higher.
What should you do if you receive one?Review your health check analytics.
Pool Enablement
Who is it for?Customers who want to be warned about status changes (enabled/disabled) in their pools.
Other options / filtersAvailable filters include:
- You can search for and add pools from your list of pools.
- You can also choose the trigger that fires the notification when the Load Balancing pool is enabled, disabled, and either enabled or disabled.
Purchase of Load Balancing.
What should you do if you receive one?No action is needed.
Load Balancing Health Alert
Who is it for?Customers who want to be warned about changes in health status in their pools or origins.
Other options / filtersAvailable filters include:
- You can search for and add pools from your list of pools, as well as Include future pools (if all pools are selected).
- You can choose the trigger that fires the notification when the health status becomes unhealthy, healthy, or either unhealthy or healthy
- You can choose the trigger that fires the notification when the event source health status changes in pool, origin, or either pool or origin.
Purchase of Load Balancing.
What should you do if you receive one?Evaluate load balancing analytics to review changes in health status over time.
Failing Logpush Job Disabled
Who is it for?Enterprise customers who use Logpush and want to monitor their job health.
Other options / filters- Notification Name: A custom name for the notification.
- Description (optional): A custom description for the notification.
- Notification Email (can be multiple emails): The email address of the recipient for the notification.
Enterprise plans.
What should you do if you receive one?In the email for the notification, you can find the destination name for the failing Logpush job. With this destination name, you should be able to figure out which zone this relates to. There can be multiple reasons why a job fails, but it is best to test that the destination endpoint is healthy, and that necessary credentials are still working. You can also check that the destination has allowlisted Cloudflare IPs.
Magic Network Monitoring - Auto Advertisement
Who is it for?Magic Transit on-demand customers who use Flow-Based Monitoring and want alerts when Magic Transit is automatically enabled.
Other options / filtersNone.
Included withPurchase of Magic Transit.
What should you do if you receive one?No action is needed. You can go to the Cloudflare dashboard to review the health and status of your tunnels.
Magic Network Monitoring - DDoS Attack
Who is it for?BYOIP and Spectrum customers with Network Analytics who want to receive a notification when Cloudflare has mitigated attacks that generate an average of at least 12,000 packets per second over a five-second period, with a duration of one minute or more.
Other options / filtersNone.
Included withPurchase of Magic Transit and/or BYOIP.
What should you do if you receive one?No action needed. Refer to DDoS alerts for more information.
Magic Network Monitoring - Volumetric Attack
Who is it for?Magic Transit on-demand customers who are using Flow-Based Monitoring to detect attacks when Magic Transit is disabled.
Other options / filtersNone.
Included withPurchase of Magic Transit.
What should you do if you receive one?If you do not have auto advertisement enabled, you need to advertise your IP prefixes to enable Magic Transit. For more information, refer to Dynamic advertisement.
Magic Tunnel Health Check Alert
Who is it for?Magic Transit and Magic WAN customers who wish to receive alerts when the percentage of successful health checks for a Magic Tunnel drops below the selected service-level objective (SLO).
Other options / filters- Notification Name: A custom name for the notification.
- Description (optional): A custom description for the notification.
- Notification Email (can be multiple emails): The email address of recipient for the notification.
- Webhooks
- Tunnels: Choose one or more tunnels to monitor.
- SLO: Define SLO threshold for Magic Tunnel health alerts. Available options are High, Medium, and Low.
Purchase of Magic Transit and Magic WAN.
What should you do if you receive one?Refer to the Magic Transit tunnel health or Magic WAN tunnel health for more information on what the issue might be.
Page Shield New Code Change Detection Alert
Who is it for?Page Shield customers who want to receive a notification when JavaScript dependencies change in the pages of their domain.
Other options / filtersNone.
Included withEnterprise plans with paid add-on.
What should you do if you receive one?Investigate to confirm that it is an expected change.
Additional informationTriggered daily.
Page Shield New Domain Alert
Who is it for?Page Shield customers who want to receive a notification when resources from new host domains appear in their domain.
Other options / filtersNone.
Included withBusiness plans or higher.
What should you do if you receive one?Investigate to confirm that it is an expected change.
Additional informationTriggered hourly.
Page Shield New Malicious Domain Alert
Who is it for?Page Shield customers who want to receive a notification when resources from a known malicious domain appear in their domain. For more information, refer to Malicious script and connection detection.
Other options / filtersNone.
Included withEnterprise plans with paid add-on.
What should you do if you receive one?Review the information in the Page Shield dashboard about the detected malicious resources, then update the pages where those resources were detected.
For more information, refer to Review scripts and connections considered malicious.
Page Shield New Malicious Script Alert
Who is it for?Page Shield customers who want to receive a notification when Cloudflare classifies JavaScript dependencies in their domain as malicious. For more information, refer to Malicious script and connection detection.
Other options / filtersNone.
Included withEnterprise plans with paid add-on.
What should you do if you receive one?Review the information in the Page Shield dashboard about the detected malicious resources, then update the pages where those resources were detected.
For more information, refer to Review scripts and connections considered malicious.
Page Shield New Malicious URL Alert
Who is it for?Page Shield customers who want to receive a notification when resources from a known malicious URL appear in their domain. For more information, refer to Malicious script and connection detection.
Other options / filtersNone.
Included withEnterprise plans with paid add-on.
What should you do if you receive one?Review the information in the Page Shield dashboard about the detected malicious resources, then update the pages where those resources were detected.
For more information, refer to Review scripts and connections considered malicious.
Page Shield New Resources Alert
Who is it for?Page Shield customers who want to receive a notification when new resources appear in their domain.
Other options / filtersNone.
Included withBusiness plans or higher.
What should you do if you receive one?Investigate to confirm that it is an expected change.
Additional informationTriggered daily.
Page Shield New Resource Exceeds Max URL Length Alert
Who is it for?Page Shield customers who want to receive a notification when a resource's URL exceeds the maximum allowed length.
Other options / filtersNone.
Included withBusiness plans or higher.
What should you do if you receive one?Manually check the resource.
Project updates
Who is it for?Customers who want to receive notifications about project-level events in Cloudflare Pages.
Other options / filtersAvailable filters include:
- Pages projects
- Environments
- Different events: Deployment started, Deployment failed, or Deployment success
All Cloudflare plans.
What should you do if you receive one?For failed deployments, review our debugging guide.
Radar Alerts
Who is it for?Customers who want to receive a notification when traffic anomalies, outages, route hijacks, or route leaks are impacting one or more countries, regions, or autonomous systems (ASNs) of interest.
Other options / filtersFilters include:
- Notification type (anomaly, outage, route hijack, route leak)
- Location (country or region)
- Autonomous systems (ASNs)
You have the option to send the notification via email, webhook, or PagerDuty.
Included withAll Cloudflare plans.
What should you do if you receive one?Further action will depend on your role. Refer to the Radar documentation for more information.
Route Leak Detection Alert
Who is it for?BYOIP customers who want to receive a notification when their prefixes are advertised in places they should not be.
Other options / filtersNone.
Included withPurchase of BYOIP.
What should you do if you receive one?Confirm your traffic is healthy. Reach out to your transit providers to ensure you are behaving as expected and ask them to follow up with any providers accepting the unauthorized routes.
Access mTLS Certificate Expiration Alert
Who is it for?Access customers that use client certificates for mutual TLS authentication. This notification will be sent 30 and 14 days before the expiration of the certificate.
Other options / filtersNone.
Included withPurchase of Access and/or Cloudflare for SaaS.
What should you do if you receive one?Upload a renewed certificate.
Advanced Certificate Alert
Who is it for?Customers with advanced certificates that want to be alerted on validation, issuance, renewal, and expiration of certificates.
Other options / filtersNone.
Included withWhen an advanced certificate is validated, issued, renewed, or expired.
What should you do if you receive one?Action only needed if notification is about a certificate that failed to be issued. Refer to SSL expired or SSL mismatch errors for more information.
Hostname-level Authenticated Origin Pulls Certificate Expiration Alert
Who is it for?Customers that upload their own certificate to use with hostname-level Authenticated Origin Pull (AOP) to secure connections from Cloudflare to their origin server. AOP certificate expiration notifications are sent 30 days and 14 days before the certificate expiry.
Other options / filtersNone.
Included withAuthenticated Origin Pull.
What should you do if you receive one?Upload a renewed certificate to use for hostname-level AOP.
SSL for SaaS Custom Hostnames Alert
Who is it for?Customers with custom hostname certificates who want to receive a notification on validation, issuance, renewal, and expiration of certificates. For more details around data formatting for webhooks, refer to the Cloudflare for SaaS docs.
Other options / filtersNone.
Included withPurchase of Cloudflare for SaaS.
What should you do if you receive one?You only need to take action if you are notified that you have a certificate that failed. You can find the reasons why a certificate is not being issued in Troubleshooting SSL errors.
Universal SSL Alert
Who is it for?Customers with universal certificates who want to receive a notification on validation, issuance, and renewal of certificates.
Other options / filtersNone.
Included withAll Cloudflare plans.
What should you do if you receive one?You only need to take action if you are notified that you have a certificate that failed. You can find the reasons why a certificate is not being issued in Troubleshooting SSL errors.
Zone-level Authenticated Origin Pulls Certificate Expiration Alert
Who is it for?Customers that upload their own certificate to use with zone-level Authenticated Origin Pull (AOP) to secure connections from Cloudflare to their origin server. AOP certificate expiration notifications are sent 30 days and 14 days before the certificate expiry.
Other options / filtersNone.
Included withAuthenticated Origin Pull.
What should you do if you receive one?Upload a renewed certificate to use for zone-level AOP.
mTLS Certificate Store Certificate Expiration Alert
Who is it for?Customers that upload their own client certificates for mTLS via bring your own CA.
This notification will be sent 30 and 14 days before the expiration of the certificate.
Other options / filtersNone.
Included withThe mTLS Certificate Store refers to customer uploaded certificates and does not include client certificates generated with the Cloudflare CA.
What should you do if you receive one?Upload a renewed certificate.
Brand Protection Alerts
Who is it for?Customers who want a summary of activity related to Brand Protection.
Other options / filtersYou can set up Brand Protection Alerts on individual monitored queries. For more details, refer to Brand Protection Alerts.
Included withProfessional plans or higher.
What should you do if you receive one?Investigate and potentially block any suspicious domains that may be trying to impersonate your brand.
Brand Protection Digest
Who is it for?Customers who want a summary of activity related to Brand Protection.
Other options / filtersYou can set up Brand Protection Digest on individual monitored queries. For more details, refer to Brand Protection Alerts.
Included withProfessional plans or higher.
What should you do if you receive one?Investigate and potentially block any suspicious domains that may be trying to impersonate your brand.
Logo Match Alerts
Who is it for?Customers who want to receive a notification when the Brand Protection system detects a new domain which is using the uploaded logo and might be infringing copyright.
Other options / filtersYou can select the query that you want to be alerted on.
Included withEnterprise plans.
What should you do if you receive one?Review the domains and URLs that are potentially impersonating your brand.
Stream Live Notifications
Who is it for?Customers who are using Stream and want to receive webhooks with the status of their videos.
Other options / filtersYou can input Stream Live IDs to receive notifications only about those inputs. If left blank, you will receive a list for all inputs.
The following input states will fire notifications. You can toggle them on or off:
live_input.connectedlive_input.disconnected
Stream subscription.
What should you do if you receive one?Stream notifications are entirely customizable by the customer. Action will depend on the customizations enabled.
Advanced Error Rate Alert
Who is it for?Enterprise customers who want to receive a notification when Cloudflare detects edge and/or origin errors. Refer to HTTP Traffic Alerts for more information.
Other options / filtersAvailable filters include:
- You can search and add domains from your list of domains.
- You can filter alerts by edge status code, origin status code, and the IP Address.
- You can also choose the trigger that fires the notification. Available triggers are low sensitivity, medium sensitivity, high sensitivity, or very high sensitivity.
You can also toggle Alert Grouping to receive separate alerts for your domain, edge status code, and/or origin status code.
Included withEnterprise plans.
What should you do if you receive one?- Use the link in the notification you received to see which error codes Cloudflare is seeing.
- Depending on the statuses you are alerting on, refer to Troubleshooting Cloudflare 5XX errors.
Traffic Monitoring alerts are not sent for each individual events, but only when a spike in traffic reaches the threshold for an alert to be sent.
These thresholds cannot be configured. Service level objectives (SLOs) are used to determine the threshold.
Origin Error Rate Alert
Who is it for?Enterprise customers who want to receive a notification when Cloudflare is unable to access their origin server. Refer to HTTP Traffic Alerts for more information.
Other options / filtersMultiple filters available:
- You can search and add domains from your list of domains.
- You can also choose the trigger that fires the notification. Available triggers are low sensitivity, medium sensitivity, high sensitivity, or very high sensitivity.
Enterprise plans.
What should you do if you receive one?- Use the link in the Notification you received to see which error codes Cloudflare is seeing from your origin.
- Refer to Troubleshooting Cloudflare 5XX errors to learn how to troubleshoot these errors.
Traffic Monitoring alerts are not sent for each individual events, but only when a spike in traffic reaches the threshold for an alert to be sent.
These thresholds cannot be configured. Service level objectives (SLOs) are used to determine the threshold.
Passive Origin Monitoring
Who is it for?Customers who want to receive a notification when Cloudflare is unable to access their origin. Customers will only receive this notification when their origin is returning a 521 error.
None.
Included withAll Cloudflare plans.
What should you do if you receive one?Refer to Troubleshooting Cloudflare 5XX errors to learn how to troubleshoot these errors.
LimitationsTraffic Monitoring alerts are not sent for each individual events, but only when a spike in traffic reaches the threshold for an alert to be sent.
These thresholds cannot be configured. Service level objectives (SLOs) are used to determine the threshold.
Traffic Anomalies Alert
Who is it for?Enterprise customers who want to receive a notification when one zone is experiencing an unexpected spike or drop in traffic. Refer to HTTP Traffic Alerts for more information.
Other options / filtersMultiple filters available:
- You can search and add domains from your list of domains.
- You can include or exclude traffic mitigated by the Web Application Firewall (WAF).
- You can choose whether to be notified of either spikes or drops in traffic.
Enterprise plans.
What should you do if you receive one?Use the link in the Notification you received to view if the spike or drop is significant enough to require further actions.
LimitationsTraffic Monitoring alerts are not sent for each individual events, but only when a spike in traffic reaches the threshold for an alert to be sent.
These thresholds cannot be configured. Z-score is used to determine the threshold.
Block Review Rejection
Who is it for?Customers who want to be notified when Cloudflare Trust & Safety rejects a request for block removal.
Other options / filtersNone.
Included withAll Cloudflare plans.
What should you do if you receive one?Take care of any abuse on your website. Then, go to the Cloudflare dashboard and request a review.
New Blocks
Who is it for?Customers who want to be notified when Cloudflare Trust & Safety places a block on their website.
Other options / filtersNone.
Included withAll Cloudflare plans.
What should you do if you receive one?Take care of any abuse on your website. Then, go to the Cloudflare dashboard and request a review.
Removed Blocks
Who is it for?Customers who want to be notified when Cloudflare Trust & Safety removes a block from their website.
Other options / filtersNone.
Included withAll Cloudflare plans.
What should you do if you receive one?This is informational follow up.
Tunnel Creation or Deletion Event
Who is it for?Customers who want to receive a notification when Cloudflare Tunnels are created or deleted in their account.
Other options / filtersNone.
Included withAll Cloudflare Zero Trust plans.
What should you do if you receive one?No action is needed.
Tunnel Health Alert
Who is it for?Customers who want to be warned about changes in health status for their Cloudflare Tunnels.
Other options / filtersNone.
Included withAll Cloudflare Zero Trust plans.
What should you do if you receive one?Monitor tunnel health over time and consider deploying cloudflared replicas or load balancers.
Health status |
Description |
|---|---|
| Healthy | The tunnel is active and serving traffic through four connections to the Cloudflare global network. |
| Degraded | The tunnel is active and serving traffic, but at least one individual connection has failed. Further degradation in tunnel availability could risk the tunnel going down and failing to serve traffic. |
| Down | The tunnel cannot serve traffic as it has no connections to the Cloudflare global network. |
| Inactive | This value is reserved for tunnels which have been created, but have never been run. |
Weekly summary
Who is it for?Customers using Web Analytics to monitor their website's performance.
Other options / filtersNone.
Included withAll Cloudflare plans.
What should you do if you receive one?No action is needed. This notification is a weekly summary with reports from your Web Analytics account. Refer to Notifications in the Cloudflare dashboard to refine your notifications settings.
Advanced Security Events Alert
Who is it for?Enterprise customers who want to receive alerts about spikes in specific services that generate log entries in Security Events. For more information, refer to WAF alerts.
Other options / filtersA mandatory filters selection is needed when you create a notification policy which includes the list of services and zones that you want to be alerted on.
- You can search for and add domains from your list of Enterprise zones.
- You can choose which services the alert should monitor (Managed Firewall, Rate Limiting, etc.).
- You can filter events by a targeted action.
Enterprise plans.
What should you do if you receive one?Review the information in Security Events to identify any possible attack or misconfiguration.
Additional informationThe mean time to detection is five minutes.
This alert will look for spikes across all services that generate log entries in security/firewall events.
LimitationsSecurity Events (WAF) alerts are not sent for each individual events, but only when a spike in traffic reaches the threshold for an alert to be sent.
These thresholds cannot be configured. Z-score is used to determine the threshold.
Security Events Alert
Who is it for?Business and Enterprise customers who want to receive alerts about spikes across all services that generate log entries in Security Events. For more information, refer to WAF alerts.
Other options / filtersA mandatory filters selection is needed when you create a notification policy which includes the list of zones that you want to be alerted on.
- You can also search for and add domains from your list of business or enterprise zones. The notification will be sent for the domains chosen.
- You can filter events by a targeted action.
Business and Enterprise plans.
What should you do if you receive one?Review the information in Security Events to identify any possible attack or misconfiguration.
Additional informationThe mean time to detection is two hours.
When setting up this alert, you can select the services that will be monitored. Each selected service is monitored separately.
LimitationsSecurity Events (WAF) alerts are not sent for each individual events, but only when a spike in traffic reaches the threshold for an alert to be sent.
These thresholds cannot be configured. Z-score is used to determine the threshold.