Skip to content

Commit 7acfd60

Browse files
[Security Center / DDoS] Add API endpoints to App Sec reports + Industry Benchmarks (#26062)
* add api endpoints * api mentions * industry benchmark clarification * wording * update industry benchmark section * note * reword note * feedback
1 parent d9f38db commit 7acfd60

File tree

1 file changed

+54
-1
lines changed

1 file changed

+54
-1
lines changed

src/content/docs/security-center/app-security-reports.mdx

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Application Security reports provide cyber attack insights and trends for all of
1717

1818
The reports are automatically generated on a monthly basis.
1919

20-
You can access reports by going to the **Security reports** page. You can access reports from previous months by selecting the month from the dropdown.
20+
You can access reports by going to the **Security reports** page or via the [API](#api). You can access reports from previous months by selecting the month from the dropdown.
2121

2222
<DashButton url="/?to=/:account/security-center/reports" />
2323

@@ -52,6 +52,14 @@ To view more details, apply filters, analyze the data, and generate ad-hoc repor
5252

5353
### Industry benchmarks
5454

55+
Industry benchmarks provide additional context for your mitigated traffic by comparing your organization's attack activity against others in the same industry. These benchmarks help you understand whether the volume and frequency of attacks you experience are typical, higher, or lower than your peers — offering a clear sense of where your organization stands within its threat landscape.
56+
57+
Beyond providing context, benchmarks can also help demonstrate value to stakeholders by quantifying the scale of threats your organization faces and how effectively Cloudflare mitigates them. This information can be useful when communicating your security posture internally or when prioritizing future security investments.
58+
59+
To ensure fairness and accuracy, Cloudflare normalizes your data before comparison. For each month, we calculate the percentage of mitigated requests relative to the total requests across your account and eligible zones. This normalization ensures that benchmarks are based on relative attack intensity rather than total traffic volume so larger or smaller organizations can be compared meaningfully.
60+
61+
The result helps you interpret your mitigated traffic data in context. For example, you may see a statement such as "_You are in the top 25% most attacked companies in the Cosmetics industry._" This insight enables you to better understand your threat exposure, communicate results to stakeholders, and understand value of the protection Cloudflare provides.
62+
5563
If your account is not assigned an industry or if the shown industry is incorrect, use the link within the report to select the correct industry.
5664

5765
It may take a while for your new selection to take effect, and it may only be applied to future reports.
@@ -75,6 +83,51 @@ A Cloudflare user must have one of the following [roles](/fundamentals/manage-me
7583

7684
---
7785

86+
## API
87+
88+
```sh title="List all report policies for a specific account"
89+
GET /accounts/{account_id}/reporting/policies
90+
```
91+
92+
```sh title="Retrieve the details of a single, specific report policy"
93+
GET /accounts/{account_id}/reporting/policies/{policy_id}
94+
```
95+
96+
```sh title="List all generated reports for a specific account"
97+
GET /accounts/{account_id}/reporting/reports
98+
```
99+
100+
```sh title="Retrieve a single, specific report, including its data and findings"
101+
GET /accounts/{account_id}/reporting/reports/{report_id}
102+
```
103+
104+
<Details header="Data returned by the API">
105+
- Account ID
106+
- Account Name
107+
- Account Industry
108+
- Time range
109+
- Total zones
110+
- Total zones analyzed
111+
- Industry percentile (nullable float)
112+
- Total requests (count, percentage)
113+
- Total mitigated requests (count, percentage)
114+
- Total served requests (count, percentage)
115+
- Top 5 hostnames by mitigated requests (hostname, count)
116+
- Top 5 source countries by served requests (country, count)
117+
- Top 5 source countries by mitigated requests (country, count)
118+
- Top 5 rules by mitigated requests (rule name, rule type, count)
119+
</Details>
120+
121+
:::note
122+
The data's time range is independent of when the report is generated.
123+
:::
124+
125+
### Cross-account reports
126+
127+
Each report is generated per account. You can use the [API](#api) to retrieve the reports for all of your accounts and aggregate the data.
128+
129+
---
130+
78131
## Limitations
79132

80133
Application Security reports currently only support US Customer Metadata Boundary (CMB). They do not support the EU CMB yet.

0 commit comments

Comments
 (0)