edgeLakeAttackAnalysis

Analyze WAF (Web Application Firewall) attack scores for a domain using Cloudflare analytics. Returns request counts by attack classification and a time-series chart.

Parameters

Parameter	Type	Required	Description
channelId	string (UUID)	Yes	The Edge Lake channel ID. Must be a channel with providerId: "edgeLake". Get this from the domains tool.
teamId	string (UUID)	Yes	The team ID the domain belongs to.
startDateTime	string	Yes	Start date/time in ISO 8601 format, e.g., 2024-01-01T00:00:00.000Z.
endDateTime	string	Yes	End date/time in ISO 8601 format, e.g., 2024-01-31T23:59:59.999Z.
granularity	enum	No	Time granularity: DAY, HOUR, or MINUTE. Defaults to DAY.
timezone	string	No	IANA timezone, e.g., America/New_York.

Attack classifications

Cloudflare classifies each request into one of these categories:

Classification	Description
attack	Confirmed attack traffic
likely_attack	Probably attack traffic
likely_clean	Probably legitimate traffic
clean	Confirmed legitimate traffic
not_scored	Not evaluated by WAF

Output

Returns:

• overview - Request counts grouped by attack classification
• chart - Time-series of attack classification distribution

Example

"Are we seeing any attack traffic this week?"

The AI assistant will call edgeLakeAttackAnalysis and display the breakdown of attack vs. clean traffic.