# Prove Cloudflare is working — first tool + proof field Source: https://ai.techclick.in/blog_cloudflare_evidence_desk Markdown: https://ai.techclick.in/blog_cloudflare_evidence_desk.md Publisher: Techclick Infosec Pvt Ltd How you prove Cloudflare is working: Security Events Action + Rule, Trace, Analytics Web Traffic, Log Explorer / Logpush, SSL/TLS edge cert Status. Five tickets with first tool and one proof field. Quick answer (say this out loud) Security Events answers “did a security product act — and which rule?” Trace answers “what would this simulated request match?” Analytics HTTP Traffic answers “is the zone even seeing requests?” Log Explorer / Logpush answers “what exactly happened for this Ray ID?” SSL/TLS Edge Certificates answers “is the edge presenting a valid cert?” A Managed Challenge is not a block. Empty Sampled logs is not “Cloudflare is down.” Trace is not production traffic. ## 1. Why “is it working?” is five questions Concept: Operators collapse five failures into one sentence. The hostname never reached the edge. A custom rule challenged /login . The rule you shipped never evaluated. Sampled logs hid the Ray ID. The Universal SSL certificate is still Pending Validation. Those are five first clicks. This page is the night-shift desk for proof . The factory taught the exchange: a Ray ID is the ticket, WAF is not Bot, 526 is origin TLS, HIT is cache. Here you learn the five official dashboards you actually open, in order, when someone asks you to prove Cloudflare is working. Hero · five tiles, one ticket Notice: five tiles, not one “Cloudflare dashboard.” You pick the tile that matches the question, then you quote one field. Interview line If they say “prove Cloudflare is working,” do not say “I opened the dashboard.” Say: “I prove the verdict with Security Events Action + Rule, the what-if with Trace, the wire with HTTP Traffic Requests , the forensic row with Log Explorer RayID , and the padlock with Edge Certificates Status .” ## 2. Mental model — five proof tools Path: Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you skip a managed ruleset at 02:00. #### 1 · Security Events Zone Analytics → Events tab (deeplink /security/analytics ). Proves one mitigated or flagged request: Action + Service + Rule. Does not prove un-actioned traffic or a simulated match. #### 2 · Trace Account Trace ( /trace ). Simulates an HTTP/S request. Proves which active rules would evaluate and execute. Does not prove what production just did. #### 3 · HTTP Traffic Zone Analytics & Logs → HTTP Traffic . Proves whether the edge saw Requests , plus Edge status code / Origin status code . A zero-request window is not a WAF skip. #### 4 · Log Explorer / Logpush Account Log Explorer → Log Search , or zone Analytics & Logs → Logs (Logpush). Proves the forensic row: RayID , Action , RuleID , Source . Sampled logs are not this store. #### 5 · Edge Certificates Zone SSL/TLS → Edge Certificates . Proves the cert the visitor sees: Type + Status (Active vs Pending Validation). Does not prove origin TLS. 526 is Full (strict) at the origin, not this page. #### Hard words, once Ray ID = cf-ray on the request. Security Events = actioned/flagged only. Security Analytics = all HTTP. firewall_events = Logpush dataset for Action + RuleID. Trace = what-if. Official docs still say Firewall events for the log dataset. Flow 1 · five tools, one question each Five proof tools and the one question each is allowed to answer - Write hostname + Ray ID + UTC first · then pick the tool Is Cloudflare working? five questions, not one Security Events This request acted? Action + Rule Analytics → Events Sampled logs not all HTTP Trace Would this match? Executed configs Account → Trace simulated HTTP/S not a live Ray ID HTTP Traffic Zone seeing hits? Requests Edge status code Analytics & Logs not a rule name Log Explorer This Ray ID? RayID + Action RuleID · Source Log Search / Logpush not a Trace replay Edge cert Padlock valid? Status Active Type · hostnames SSL/TLS → Edge not origin 526 Empty Security Events is data. It usually means nothing was actioned or the row was sampled out. Do not invent a skip from an empty Events tab. Start at HTTP Traffic or Log Explorer. Read left → right. Each box is allowed one claim. If you cannot name the field, you are not proving — you are guessing. Say this out loud I prove the verdict, then the what-if, then the wire, then the forensic row, then the padlock. I do not skip a managed ruleset, purge the zone, or pause Cloudflare until I can quote the field that made me do it. ## 3. Decision flow — ticket → first tool Flowchart first. Do not open the custom-rule editor until a diamond says so. Path · pick the branch before the menu Notice: the diamond is the ticket. You pick a path before you open a menu. The proof field comes last. Flow 2 · first-tool diamond Decision diamond from symptom to first proof tool Symptom first · tool second · field third What must we prove? On the edge? or already inside? Site looks dead HTTP Traffic Requests 403 / challenge Security Events Action + Rule Should have fired Trace Executed configs Have a Ray ID Log Explorer WHERE RayID = Browser cert warn Edge Certificates Status HTTP Traffic Requests = 0 → stop. There is no Action to chase. Fix DNS / proxy status (orange cloud) / nameservers. Then re-open Events. Diamond = decision. Do not skip a managed ruleset from the bottom box. Older tenants may still label Events under Security. Official path is Analytics → Events tab. Read the diamond first. A missing Ray ID never starts in Log Explorer. A browser cert warning never starts in WAF. Zero Requests never starts in RuleID . ## 4. How to choose — first tool + proof field Do: Print this next to the dashboard. If you cannot recite the proof field, you are not ready to change anything. If the ticket says… First tool (official path) Proof field Do not open first 403 / challenge / “Cloudflare blocked login” Zone Analytics → Events tab · Sampled logs. Deeplink /security/analytics Action (block / managedchallenge / challenge / log / skip) + Service + Rule A global WAF skip “This rule should have fired” after you shipped it Account Trace · /trace (Administrator / Super Administrator) Evaluated and executed configurations, in evaluation order Log Explorer (that is what did happen) Whole site dead / “is Cloudflare even working?” / no Ray ID Zone Analytics & Logs → HTTP Traffic · /analytics/traffic Requests in the UTC window + Edge status code (add Origin status code if you have it) A new custom Allow Ray ID on the error page / Sampled logs empty / need the forensic row Account Log Explorer → Log Search , or zone Analytics & Logs → Logs (Logpush) RayID + Action + RuleID + Source on firewall_events / http_requests Trace Skip Challenge Browser cert warning / padlock broken / not a 403 Zone SSL/TLS → Edge Certificates · /ssl-tls/edge-certificates Certificate Status = Active (and Type / hostnames covered) A managed-ruleset skip Sampling caveat (official) Security Events may use sampled data. Official Ray ID docs: if sampled data is applied, you might not see all events and filters might not return the expected results. Narrow the time window, then escalate the same Ray ID to Log Explorer or a Logpush firewall_events job. Do not declare “no hit” from one empty Sampled-logs page. Events vs Analytics vs firewall_events Security Events = requests Cloudflare security products acted on or flagged ( firewallEventsAdaptive ). Security Analytics = all incoming HTTP, including requests nothing touched. Logpush firewall_events = the raw Action / RuleID / Source / RayID dataset you ship to a SIEM. Same family. Three doors. ## 5. Runbook Side A → B → C Side A proves the security verdict and the what-if. Side B proves the zone is on the wire and the padlock is valid. Side C proves the forensic row. On a messy Sev-2, do them in this order until a field lights up. ### Side A — Security Events + Trace (verdict and what-if) #### Open Security Events, not the rule editor Official path: in the Cloudflare dashboard go to the Analytics page for the zone, then select the Events tab. Deeplink: dash.cloudflare.com/?to=/:account/:zone/security/analytics . Enterprise also has account-level Security events. Source: Security Events — Location in the dashboard. - #### Filter, then read the two columns that close a WAF ticket Add filter: Action, Host, Path, IP, or Ray ID. Expand the Sampled log. Quote Action and the applied security feature (Managed rules, Rate limiting rules, Custom rules, Bot Fight Mode). That pair is the ticket. A single HTTP request can generate more than one security event. Source: Security Events — Sampled logs; Event actions. - #### If Events is empty, do not invent a skip Empty Sampled logs means either nothing was actioned/flagged, or sampling hid the row. Switch to Security Analytics (same Analytics page — all traffic) or jump to Side C. Source: Security Analytics vs Security Events. - #### If the question is “would this match?”, open Trace Path: account Trace · dash.cloudflare.com/?to=/:account/trace . Enter a hostname that belongs to the account, HTTP method, optional User-Agent / geolocation / Bot Score / request body. Select Send Trace . Inactive rules are not evaluated. Administrator or Super Administrator only. Source: Use Cloudflare Trace. dash.cloudflare.com · app.example.test · Analytics → Events Training mock · not live Analytics / Events / Sampled logs ### Security Events Host app.example.test Time range Last 24 hours Path /login Action Managed Challenge Time (UTC) Action Service Rule Ray ID 01:38:11 log Managed rules 100203 a1b2c3d4e5f67890 01:41:07 managedchallenge Rate limiting rules login-20r a1b2c3d4e5f67891 Add filter Apply Source: Cloudflare Docs — Security Events (Analytics → Events tab; Sampled logs Action + applied security feature). Lab zone app.example.test only. Training mock · not live. dash.cloudflare.com · Trace · account Training mock · not live Trace / Send Trace / Trace results ### Trace a request URL https://app.example.test/login Method POST User Agent lab-browser/1.0 Skip Challenge off (default) TRACE RESULTS (evaluation order) · Results shown: matching only http_request_firewall_custom · custom rule login-allow-office · skip http_request_ratelimit · login-20r · managed_challenge http_request_firewall_managed · Cloudflare Managed Ruleset · no match Inactive rules were not evaluated. All configurations Send Trace Source: Cloudflare Docs — Trace a request; Use Cloudflare Trace (account /trace ; evaluated and executed configurations). Training mock · not live. ### Side B — HTTP Traffic + Edge Certificates (the wire and the padlock) - #### Prove the zone is seeing requests Path: zone Analytics & Logs page · HTTP Traffic tab. Deeplink: dash.cloudflare.com/?to=/:account/:zone/analytics/traffic . Quote Requests for the UTC window on the ticket. Filter Host / Path / Edge status code / Origin status code / Security Action if the plan exposes those filters. Source: Zone Analytics — View your website analytics. - #### Read Edge status separately from Origin status Edge status code is what Cloudflare returned to the client. Origin status code is what the origin returned on a cache miss. A 403 at the edge with no origin status is a security action. A 526 / 525 at the edge is TLS to origin, not WAF. Source: Zone Analytics — HTTP Traffic filters. - #### If the browser shows a cert warning, open Edge Certificates Path: SSL/TLS → Edge Certificates . Deeplink: dash.cloudflare.com/?to=/:account/:zone/ssl-tls/edge-certificates . Quote Type (Universal / Advanced / Custom) and Status . Official HTTP DCV check: Status must be Active . Universal SSL covers the apex and first-level subdomains only. Source: Edge certificates; Changing DCV method — HTTP; General SSL errors. - #### Do not confuse Status with encryption mode Edge Certificates Status is the visitor padlock. Encryption mode (Off / Flexible / Full / Full (strict)) lives on SSL/TLS Overview ( /ssl-tls ). 526 is Full (strict) failing to validate the origin cert. That is a factory ticket, not this Status column. Green success on Side B HTTP Traffic shows Requests in the same minute the user failed. If they reported a padlock error, Edge Certificates Status is Active for that hostname — or you have quoted Pending Validation / missing coverage and stopped chasing WAF. ### Side C — Log Explorer / Logpush (the forensic row) - #### When Sampled logs are not enough, leave Events Official Ray ID page: all customers can look up a Ray ID in Security Events Sampled logs; sampling can hide it. Next official door is Log Explorer . Path: Log Explorer → Log Search . Deeplink: dash.cloudflare.com/?to=/:account/log-explorer/log-search . Needs the dataset enabled (Manage datasets) and Logs Read. Source: Cloudflare Ray ID; Log Search. - #### Query the Ray ID, then read Action + RuleID Select Dataset ( http_requests or the firewall-events dataset you enabled). Add filter Field = RayID, or Custom SQL. Official example uses WHERE RayID = '…' . For the security verdict, Logpush field names on firewall_events are Action , RuleID , Source , RayID , Description , EdgeResponseStatus . Source: Log Search; Firewall events dataset. - #### If you do not have Log Explorer, use the Logpush job you already run Path: account Logpush /logs , or zone Analytics & Logs → Logs /analytics/logs . Create / inspect a job for dataset firewall_events or http_requests . Quote the same four fields from the SIEM. Enterprise Instant Logs is a live stream, not a 24-hour hunt. Source: Enable Logpush destinations; Cloudflare Logs. dash.cloudflare.com · Log Explorer → Log Search Training mock · not live Log Explorer / Log Search / Custom SQL ### Log Search Dataset firewall_events · app.example.test Time period Previous 12 hours Custom SQL — lab only SELECT EdgeStartTimestamp, ClientRequestHost, ClientRequestPath, EdgeResponseStatus, Action, RuleID, Source, RayID FROM firewall_events WHERE date = '2026-08-16' AND RayID = 'a1b2c3d4e5f67891' LIMIT 1 RayID Action RuleID Source EdgeResponseStatus a1b2c3d4e5f67891 managedchallenge login-20r ratelimit 403 Save query Run query Source: Cloudflare Docs — Log Search (dashboard path + WHERE RayID ); Firewall events fields ( Action , RuleID , Source , RayID ). Training mock · not live. Fields you write in the ticket Zone: app.example.test (lab) UTC window: 01:30–01:50 Events path: Analytics → Events → Sampled logs Quote: Action + Service + Rule + Ray ID If empty: HTTP Traffic Requests, then Log Explorer WHERE RayID Trace path: Account → Trace → Send Trace Cert path: SSL/TLS → Edge Certificates → Status Logpush path: Analytics & Logs → Logs (zone) or account /logs Green success on each side - Side A verdict: Sampled log names Action + Service + Rule for that Ray ID. Side A what-if: Trace lists the executed configuration in evaluation order. - Side B wire: HTTP Traffic Requests exist in the same minute. Side B padlock: Edge Certificates Status is Active for the hostname. - Side C: Log Explorer or Logpush returns one row for that RayID with Action + RuleID + Source . ## 6. Five tickets as full stories These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only. Zone app.example.test , client 203.0.113.88 . Ticket Symptom First tool Proof field CFED-01 “Is Cloudflare even working?” — site looks dead, no Ray ID HTTP Traffic Requests + Edge status code CFED-02 After a new rate-limit, /login challenges real users Security Events Action = managedchallenge · Rule = the rate-limit CFED-03 “This custom rule should have fired” after you shipped it Trace Executed configuration (or no match) in evaluation order CFED-04 Ray ID on the error page is missing from Sampled logs Log Explorer / Logpush RayID + Action + RuleID + Source CFED-05 Browser cert warning on a new hostname — not a 403 Edge Certificates Status (Active vs Pending Validation) + Type / SAN ### CFED-01 — Prove the wire (HTTP Traffic) 01:42 · P1. Priya: “Cloudflare is down.” No error page, no Ray ID. L1 already drafted a skip for the Cloudflare Managed Ruleset. First tool: zone Analytics & Logs → HTTP Traffic . Filter last 30 minutes. Host = app.example.test . If Requests = 0: the edge never saw the client. Quote that count. Next check is DNS / proxy status (orange cloud) / nameservers — not Security Events Action . Grey-cloud hostnames never produce a Cloudflare Ray ID. If Requests > 0: add filter Edge status code . A pile of 5xx is origin or edge TLS. A pile of 403 / 429 is a security ticket — now you are allowed to open Events. HTTP Traffic is not a rule name. Trap Do not skip WAF from a Slack screenshot. Unique Visitors is a Web Traffic roll-up, not a verdict. Workers subrequests do not appear in zone Traffic Analytics — they live under Workers & Pages. ### CFED-02 — Prove the security transaction (Security Events) 02:05 · P2. After last night’s login rate-limit, humans fail the challenge loop. Someone wants “WAF off for /login .” First tool: Analytics → Events . Filter Host + Path /login + last hour. Expand Sampled logs. Proof field: page GET Action = log (Managed rules 100203 did not block). POST Action = managedchallenge and Service = Rate limiting rules, Rule = login-20r . That name is the ticket. Tune that one rule — or raise the threshold — then re-read the same two columns. Challenge is not a block. Source: Security Events — Event actions; Managed Challenge list. Close I would not skip the managed ruleset. I would quote Action + Rate limiting rule on the POST. A change is not proof until the same filter returns allow or a solved challenge. ### CFED-03 — Prove the what-if (Trace) 02:20 · P2. You shipped a custom skip for the office NAT. Attack traffic still looks challenged. L1 wants the rule rewritten from a HAR guess. First tool: account Trace . URL https://app.example.test/login , method POST, geolocation = the office country, User-Agent from the HAR. Send Trace. Proof field: the executed configuration list. If login-allow-office never appears, the expression did not match (IP field, skip-challenge off, or the rule is off). If it appears as skip and a later rate-limit still executes, evaluation order — not “Cloudflare ignored the rule” — is the ticket. Inactive rules are not evaluated. Source: Use Cloudflare Trace — Steps in trace results. Close Trace is a simulation. It does not create a Ray ID and it does not appear in Events. After you fix the expression, prove production with a new Events row or a Log Explorer RayID . ### CFED-04 — Prove the forensic row (Log Explorer / Logpush) 02:40 · P2. User pasted Ray ID a1b2c3d4e5f67891 from the challenge page. Security Events Sampled logs for that ID is empty. L1 says “so Cloudflare did nothing.” First tool: Log Explorer → Log Search . Dataset you enabled. Custom SQL WHERE RayID = 'a1b2c3d4e5f67891' and a tight date predicate. If Log Explorer is not on the contract, query the Logpush firewall_events job in the SIEM. Proof field: Action + RuleID + Source + EdgeResponseStatus on that Ray ID. Official Firewall events Action values include block , managedchallenge , log , skip , bypass . Official Source values include firewallcustom , firewallmanaged , ratelimit , botfight , botmanagement . Empty Sampled logs plus a Log Explorer hit is sampling, not “no event.” Trap Ray IDs are not guaranteed unique. Official docs say different requests may share a Ray ID. Pair Ray ID with timestamp + path. Do not paste a live customer Ray ID with PII into a public channel. ### CFED-05 — Prove the padlock (Edge Certificates Status) 03:00 · P3. New hostname pay.app.example.test . Chrome: “Your connection is not private.” Someone typed Sev-1 and drafted a WAF skip. First tool: SSL/TLS → Edge Certificates . Look for Type Universal / Advanced / Custom covering that hostname. Quote Status . Proof field: Universal SSL covers apex + first-level subdomains only. pay.app.example.test is a second-level subdomain — official General SSL errors page. Status Pending Validation, or no certificate that lists the name, is the ticket. Fix coverage (Advanced / Custom / Total TLS) or grey-cloud only if origin already has a valid cert. This is not a 403 and it is not 526. Close I would leave WAF alone. I would paste Type + Status + hostnames. If Status is Active on the apex but this hostname is not on the cert, that is coverage — not “Cloudflare is down.” ## 7. Traps + close-the-ticket proof Proof · named field, then Closed Notice: the close is a named column on a timestamp, not a screenshot of the user’s login tab. You see Weak close Strong close HTTP Traffic Requests = 0 “Cloudflare is down” / skip WAF Quote Requests = 0; fix DNS / orange cloud; reload Traffic HTTP Traffic Requests > 0, still failing “Cloudflare is fine” You only proved the wire. Open Events or Edge status code. Action = managedchallenge “WAF blocked us” Challenge is not a block. Quote Service + Rule. Tune that object. Empty Sampled logs Nothing happened / disable managed rules Sampling or no action. HTTP Traffic, then Log Explorer RayID . Trace shows a skip “Production is skipping” Trace is a simulation. Confirm with Events or Log Explorer. Edge Certificates Status Active “TLS is fine, so not Cloudflare” You proved the visitor padlock. 526 is origin + Full (strict). Status Pending Validation / hostname missing Skip WAF / pause the zone first Quote Type + Status + SAN. Fix coverage or DCV. Logpush http_requests with no Action “SIEM proves allow” Security verdict lives on firewall_events Action + RuleID. Proof checklist before you leave the bridge - UTC window written next to the tool you opened. - Wire proved with HTTP Traffic Requests when the ticket is “is Cloudflare even working?” - One transaction quoted: Events Action + Rule, or Trace executed config, or Log Explorer RayID + RuleID , or Edge Certificates Status . - Next tool named — or change-control owner named. No skip / purge / pause without residual control. - Peer hostname or second Ray ID compared when you claim “not a tenant outage.” - Sampled logs not used as the only “no event” proof. 526 not used as Edge Certificates Status. Interview close I name the question, then the first tool, then one official field. Security Events proves the verdict. Trace proves the what-if. HTTP Traffic proves the wire. Log Explorer / Logpush proves the forensic row. Edge Certificates Status proves the padlock. I do not skip a ruleset, pause the zone, or replace an origin cert until that field is on the ticket. Factory model: a Ray ID is a ticket . ## Knowledge check Six night-shift judgments. Each maps to a first tool or a proof field. Check answers, then Reset if you picked the wrong surface. Q1 Slack: “Is Cloudflare even working?” No Ray ID, no error page. You have not opened WAF yet. First proof? Skip the Cloudflare Managed Ruleset for the zone Analytics & Logs → HTTP Traffic — quote Requests (and Edge status code) in the UTC window Account Trace a POST to /login Disable Universal SSL Correct: b . Official Zone Analytics HTTP Traffic path. Zero Requests means there is no Action to hunt. Re-read Side B step 1 and CFED-01. Q2 A new login rate-limit shipped an hour ago. Humans hit a challenge loop on /login . Which proof field closes CFED-02? Security Events Sampled logs: Action + Service / Rule on the POST Edge Certificates Status HTTP Traffic Unique Visitors Trace with Skip Challenge enabled, and nothing else Correct: a . Official Security Events Sampled logs. Challenge is not a block. Unique Visitors is not a rule. Re-read Side A steps 1–2 and CFED-02. Q3 You shipped a custom skip for the office NAT. Attack traffic still looks challenged. First tool + field? Purge everything — cache must be the skip HTTP Traffic Page views — a dip proves the rule fired Account Trace — evaluated and executed configurations in order SSL/TLS Overview encryption mode Correct: c . Official Trace path. Inactive rules are not evaluated. Trace is a what-if, not a live Ray ID. Re-read Side A step 4 and CFED-03. Q4 The user pasted a Ray ID from the challenge page. Security Events Sampled logs for that ID is empty. First tool + proof? Turn WAF off — empty Events means Cloudflare did nothing Log Explorer → Log Search WHERE RayID = … (or Logpush firewall_events Action + RuleID + Source) Trace Skip Challenge proves the production row Always Use HTTPS Correct: b . Official Ray ID page: sampling can hide Sampled logs. Next door is Log Explorer or Logpush. Re-read Side C and CFED-04. Q5 Visitors to pay.app.example.test see a browser certificate warning, not a Cloudflare 403. What do you do first? Skip the OWASP managed ruleset Force a Bot Fight Mode off switch Purge / because CF-Cache-Status must be HIT Leave WAF alone. Open SSL/TLS → Edge Certificates and quote Status + Type / hostnames Correct: d . Official Edge Certificates path. Universal SSL does not cover second-level subdomains. 526 is origin + Full (strict), not this Status column. Re-read Side B steps 3–4 and CFED-05. Q6 Security Events is empty for the last 15 minutes. Users still fail. What is that empty page allowed to mean? No security product actioned or flagged those requests — or sampling hid the row. Do not invent a skip; check HTTP Traffic Requests / Edge status, then Log Explorer or Edge Certificates Status WAF is down — disable managed rules Trace already ran in production, so Events stays empty Logpush http_requests without Action proves the request was blocked Correct: a . Official Events vs Analytics split, plus the sampling caveat. Trace does not write Events. Re-read Flow 2 bottom box, the sampling callout, and CFED-01 / CFED-04. Check answers Reset ## Sources - Cloudflare Docs — Security Events (Analytics → Events tab; Sampled logs; Action; sampling; firewallEventsAdaptive ) - Cloudflare Docs — Security Analytics (all HTTP vs actioned-only; Logs → Log Explorer) - Cloudflare Docs — Trace a request (simulated HTTP/S; Trace vs Log Explorer) - Cloudflare Docs — Use Cloudflare Trace (dashboard /trace ; Send Trace; executed configurations) - Cloudflare Docs — Zone Analytics (Analytics & Logs → HTTP Traffic; Requests; Edge / Origin status code) - Cloudflare Docs — Cloudflare Ray ID (Sampled logs lookup; sampling caveat; Log Explorer) - Cloudflare Docs — HTTP headers ( Cf-Ray ) - Cloudflare Docs — Log Explorer - Cloudflare Docs — Log Search ( /log-explorer/log-search ; WHERE RayID ) - Cloudflare Docs — Firewall events dataset ( Action , RuleID , Source , RayID ) - Cloudflare Docs — Enable Logpush (R2) (account /logs ; zone /analytics/logs ) - Cloudflare Docs — Edge certificates (dashboard /ssl-tls/edge-certificates ) - Cloudflare Docs — HTTP DCV (Status = Active) - Cloudflare Docs — General SSL errors (Universal coverage; Pending Validation) - Cloudflare Docs — Actions (block, challenge, managed challenge, skip, log) - Cloudflare Docs — Proxy status (orange cloud vs DNS only) Related: Blog 1 · Cloudflare session factory · WAF skip tuning · Bot login abuse · WAF troubleshooting command center · Cloudflare WAF hub --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt