Cloudflare Gateway Network Logs

Cloudflare Gateway Network logs provide detailed information about network traffic and security events processed through Cloudflare’s Zero Trust Gateway. These logs capture data about user connections, application access, network policies, and security threats detected by Cloudflare’s network security services.

Ingest Methods

Setup the ingestion of this source using one of the following guides.

If using an AWS S3 bucket use the following SNS topic ARN to send your bucket notifications.

arn:aws:sns:<REGION>:253602268883:runreveal_cf_gateway_network

⚠️

SNS topic & Custom SQS. Use the ARN above in your event notification tied to your S3 bucket—the topic name must match (runreveal_…; hyphens in the source id become underscores). For Custom SQS, set the queue URL and region in RunReveal; see AWS S3 Bucket with Custom SQS.

Note: BYOC, On-Prem, and BYODB customers must use their AWS account ID in the ARN instead of 253602268883.

Setup

Setting up Cloudflare Gateway Network logs requires the use of Cloudflare Logpush.

Navigate to the Logpush setup page in your Cloudflare account and create a new logpush job that sends your access request logs to your storage bucket.

Once created Cloudflare will begin to push logs to your bucket and RunReveal will start to ingest them.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: cf_gateway_network_logs (32 columns)

Column	Type
`AccountID`	String
`Action`	String
`ApplicationIDs`	ArrayRaw
`ApplicationNames`	ArrayRaw
`CategoryIDs`	ArrayRaw
`CategoryNames`	ArrayRaw
`Datetime`	String
`DestinationIP`	String
`DestinationIPContinentCode`	String
`DestinationIPCountryCode`	String
`DestinationPort`	Int
`DetectedProtocol`	String
`DeviceID`	String
`DeviceName`	String
`Email`	String
`OverrideIP`	String

Column	Type
`OverridePort`	Int
`PolicyID`	String
`PolicyName`	String
`ProxyEndpoint`	String
`SNI`	String
`SessionID`	String
`SourceIP`	String
`SourceIPContinentCode`	String
`SourceIPCountryCode`	String
`SourceInternalIP`	String
`SourcePort`	Int
`Transport`	String
`TransportProtocol`	String
`UserID`	String
`VirtualNetworkID`	String
`VirtualNetworkName`	String

Gateway HTTP HTTP