Gateway analytics (DNS, HTTP, network sessions)

Gateway analytics include three separate dashboards:

• HTTP request analytics.
• DNS query analytics.
• Network session analytics.

To review Gateway analytics, log in to Zero Trust ↗ and go to Analytics > Dashboards > select your desired dashboard.

HTTP request analytics

The HTTP request analytics dashboard is powered by your Gateway HTTP policies. If you are not using Gateway HTTP policies, the dashboard will appear empty.

The HTTP request analytics dashboard helps you identify trends in how your HTTP policies are applied over time. By visualizing allowed, isolated, and do not inspect requests, the dashboard provides insights into traffic behavior and policy trends, making it easier to spot anomalies or shifts in usage patterns.

To review a detailed description of an HTTP request and its associated policy, log in to Zero Trust ↗ and go to Logs > Gateway > HTTP.

Provided analytics

• HTTP Requests over time
  • Time series view of HTTP requests
• Top Actions
• Top Countries
• Top Blocked Users
• Top Bandwidth Consumers
• Top Devices
• Top Source IPs

DNS query analytics

The DNS query analytics dashboard is powered by your Gateway DNS policies. If you are not using Gateway DNS policies, the dashboard will appear empty.

The DNS query analytics dashboard helps you identify trends in how your DNS policies are applied over time. By visualizing allowed, blocked, and overridden queries, the dashboard provides insights into traffic behavior and policy trends, making it easier to spot anomalies or shifts in usage patterns.

To review a detailed description of a DNS query and its associated policy, log in to Zero Trust ↗ and go to Logs > Gateway > DNS.

Provided analytics

• DNS Queries over time
  • Time series view of DNS queries
• Top Actions
• Top Countries
• Top Blocked Users
• Top Allowed Users
• Top Blocked Devices

Network session analytics

The Network session analytics dashboard is powered by your Gateway network policies. If you are not using Gateway network policies, the dashboard will appear empty.

The Network session analytics dashboard helps you identify trends in how your network policies are applied over time. By visualizing allowed, blocked, and overridden sessions, the dashboard provides insights into traffic behavior and policy trends, making it easier to spot anomalies or shifts in usage patterns.

To review a detailed description of a network session and its associated policy, log in to Zero Trust ↗ and go to Logs > Gateway > Network.

Provided analytics

• Network Sessions over time
  • Time series view of network sessions
• Top Actions
• Top Countries
• Top Blocked Users
• Top Bandwidth Consumers
• Top Devices
• Top Source IPs

GraphQL queries

You can use the GraphQL Analytics API to query your Gateway Analytics data. Available datasets for Gateway include:

Dataset	Description
gatewayL4DownstreamSessionsAdaptiveGroups	Metrics for Gateway network sessions from user devices to the Cloudflare global network.
gatewayL4UpstreamSessionsAdaptiveGroups	Metrics for Gateway network sessions from the Cloudflare global network to user devices.
gatewayL4SessionsAdaptiveGroups	Metrics for Gateway network sessions with adaptive sampling.
gatewayL7RequestsAdaptiveGroups	Metrics for Gateway HTTP requests with adaptive sampling.
gatewayResolverQueriesAdaptiveGroups	Metrics for Gateway DNS queries with adaptive sampling.
gatewayResolverByRuleExecutionPerformanceAdaptiveGroups	Time to execute Gateway DNS policies on the Cloudflare global network.
gatewayResolverByCustomResolverGroups	Metrics for Gateway DNS queries resolved using custom resolvers.
gatewayResolverByCategoryAdaptiveGroups	Metrics for Gateway DNS queries sorted by domain category with adaptive sampling.

To explore the schema, you can use a GraphQL client such as GraphiQL ↗ or Altair ↗.

1. Create an API token with the following permissions:

   Type	Item	Permission
   Account	Account Analytics	Read

2. In your GraphQL client, add your API token as an Authorization header.

3. Compose a query to access your Gateway Analytics datasets. For example, you can query the gatewayResolverQueriesAdaptiveGroups dataset to return the adaptive groups of DNS queries resolved by Gateway:

   query GatewaySampleQuery($accountTag: string!, $start: Time) {
     viewer {
       accounts(filter: { accountTag: $accountTag }) {
         gatewayResolverQueriesAdaptiveGroups(
           filter: { datetime_gt: $start }
           limit: 10
         ) {
           count
           dimensions {
             queryNameReversed
             resolverDecision
           }
         }
       }
     }
   }

   Run in GraphQL API Explorer

For more information, refer to Compose a query in GraphiQL.