Cloudflare Gateway DNS

Cloudflare Gateway DNS logs capture DNS queries made through Cloudflare’s secure DNS filtering service, which provides protection against malware, phishing, and unauthorized content access. These logs include details such as the domain names requested, the user or device making the request, and whether the request was blocked or allowed based on security policies. The logs are valuable for monitoring web traffic, enforcing content filtering, and detecting potentially malicious or risky domains.

Ingest Methods

Setup the ingestion of this source using one of the following guides.

If using an AWS S3 bucket use the following SNS topic ARN to send your bucket notifications.

arn:aws:sns:<REGION>:253602268883:runreveal_cf_gateway_dns

Setup

Setting up Cloudflare gateway DNS logs requires the use of Cloudflare Logpush.

Navigate to the Logpush setup page in your Cloudflare account and create a new logpush job that sends gateway DNS logs to your storage bucket.

Once created Cloudflare will begin to push logs to your bucket and RunReveal will start to ingest them.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: cf_gateway_dns_logs (63 columns)

Column	Type
`workspaceID`	String
`sourceID`	String
`sourceType`	LowCardinality(String)
`sourceTTL`	UInt32
`receivedAt`	DateTime
`id`	String
`eventTime`	DateTime
`eventName`	String
`eventID`	String
`srcIP`	String
`srcASCountryCode`	String
`srcASNumber`	UInt32
`srcASOrganization`	String
`srcCity`	String
`srcConnectionType`	String
`srcISP`	String
`srcLatitude`	Float64
`srcLongitude`	Float64
`srcUserType`	String
`dstIP`	String
`dstASCountryCode`	String
`dstASNumber`	UInt32
`dstASOrganization`	String
`dstCity`	String
`dstConnectionType`	String
`dstISP`	String
`dstLatitude`	Float64
`dstLongitude`	Float64
`dstUserType`	String
`actor`	Map(String, String)
`tags`	Map(String, String)
`resources`	Array(String)

Column	Type
`serviceName`	String
`readOnly`	Bool
`rawLog`	String
`ApplicationID`	Int64
`ColoCode`	String
`ColoID`	Int64
`Datetime`	String
`DeviceName`	String
`DstIP`	String
`DstPort`	Int64
`Email`	String
`Location`	String
`MatchedCategoryNames`	Array(String)
`Policy`	String
`PolicyID`	String
`Protocol`	String
`QueryCategoryNames`	Array(String)
`QueryName`	String
`QueryNameReversed`	String
`QuerySize`	Int64
`QueryType`	Int64
`QueryTypeName`	String
`RCode`	Int64
`RData`	Array(String)
`ResolvedIPs`	Array(String)
`ResolverDecision`	String
`SrcIP`	String
`SrcPort`	Int64
`TimeZone`	String
`TimeZoneInferredMethod`	String
`UserID`	String

Firewall (WAF)Gateway HTTP