Cloudflare

The Cloudflare integration connects Palo Alto Networks Cortex XCOR with Cloudflare zone analytics. Cortex XCOR polls the Cloudflare GraphQL Analytics API and ingests HTTP request, bandwidth, threat, security event, and DNS query metrics for each zone your API token can access. This integration collects Cloudflare metrics. To ingest Cloudflare logs with Palo Alto Networks Telemetry Pipeline, see the Cloudflare LogPush source plugin.

​

Supported telemetry types

​

Compatibility

The Cloudflare integration works with:

• The Cloudflare GraphQL Analytics API, using the zone-scoped httpRequests1mGroups, httpRequestsAdaptiveGroups, firewallEventsAdaptiveGroups, and dnsAnalyticsAdaptiveGroups datasets.
• Any zone whose plan grants GraphQL Analytics access. Which datasets a zone exposes depends on its plan and settings, so not every zone produces every metric: HTTP metrics require both HTTP datasets, security event metrics require both HTTP datasets and the firewall events dataset, and DNS metrics require the DNS dataset.
• Every zone the API token can access, across all the accounts it covers. Every series carries the zone and account it belongs to.

​

Prerequisites

The Cloudflare integration requires:

• A Cloudflare account with GraphQL Analytics access on the zones you want to collect.
• A Cloudflare API token scoped to the zones you want to collect, or to all zones. User API tokens (cfut_ prefix), account API tokens (cfat_ prefix), and older unprefixed tokens all work. The token must include both of these zone permissions:
  • Zone > Zone > Read (to list zones)
  • Zone > Analytics > Read (to query GraphQL Analytics)
  The token is stored write-only through the Integrations Hub Configurations tab: it can be replaced, but never read back.

​

Configure the integration

1. In Cloudflare, create a custom API token under My Profile > API Tokens. For each permission, set the scope to Zone, then add:
   • Zone > Zone > Read
   • Zone > Analytics > Read
   Apply both permissions to the zones you want to collect, or to All zones.
2. In Cortex XCOR, open the Integrations Hub and select Cloudflare.
3. On the Configurations tab, add or edit a configuration and enter the API token.
4. Save the configuration.

​

Token validation

When you save, Cortex XCOR verifies that the token authenticates. An invalid or revoked token returns cloudflare token is not valid, and an expired or disabled token returns a message saying the token is not active. If Cloudflare is briefly unavailable, save fails as temporarily unavailable. Try again. Save doesn’t verify that the token has Zone read or Analytics read permissions. A configuration can save successfully and still collect no data if permissions are insufficient.

​

Validate metrics ingestion

1. Allow up to about 15 minutes after saving for the first metrics to appear. Cortex XCOR syncs zone metadata about every five minutes before collection starts. After that, the newest samples stay about ten minutes behind real time. See Limitations below.
2. In Metrics Explorer, query one metric over a range, substituting one of your zones. The newest point is about ten minutes old, so a query evaluated only at the current time returns nothing.
   sum(sum_over_time(cloudflare_http_requests_total{zone_name="<your zone>"}[30m]))
   
   A result means data is flowing.
3. Confirm the set of collected zones:
   count by (zone_name) (count_over_time(cloudflare_http_requests_total[30m]))
   

​

Dashboards

The integration includes an Overview dashboard that summarizes zone traffic, security, caching, and DNS. Open it from the Assets tab on the Cloudflare integration page in the Integrations Hub. For more about bundled dashboards, see Use bundled assets.

​

Metric semantics

Ingested metric names use the cloudflare_ prefix followed by the metric suffix (for example, cloudflare_http_requests_total). Search for the prefix cloudflare_ in Metrics Explorer to browse ingested series. HTTP and DNS counts are stored as delta counters, one sample per one-minute GraphQL bucket. Security event counts are delta counters too, with one sample per label combination for each one-minute collection window. Query them with sum_over_time() for totals and sum_per_second() for rates. increase() and rate() need two samples in the window, so they return nothing for a quiet zone with a single bucket. For more, see Querying delta temporality metrics. The exception is cloudflare_http_uniques_total: each sample is a per-minute unique-visitor count, so summing it over a longer window overcounts visitors who return. Averaged and percentile metrics are point-in-time gauges. Every series includes zone_id, zone_name, account_id, and account_name labels that identify the zone and account it belongs to. Additional labels depend on the metric, such as country, status_code, or query_type. Security event counts carry action, firewall_source, rule_id, and host. The firewall_source label holds the Cloudflare source field. For the full metric catalog (names, types, units, and descriptions), open the Metrics tab on the Cloudflare integration page in the Integrations Hub.

​

Troubleshooting

The following table lists common problems and how to resolve them:

​

Limitations

• The integration collects metrics only. It doesn’t collect logs, traces, or events.
• Zone scope is determined by the API token permissions, not by a separate zone list in the configuration form.
• Ingested samples trail real time by about ten minutes because of the ingest delay applied during collection.
• Security event counts are estimates from Cloudflare’s adaptive sampling. Each zone keeps at most 10,000 combinations of action, source, rule, and host per minute, and the least frequent combinations are dropped when a zone exceeds that.