Logs - Account-scoped firewall events dataset in Logpush
- Announced
- Tags
- Logs
- Severity
- info, set by
reef/rss-rule-v1 - Source
- https://developers.cloudflare.com/changelog/post/2026-06-30-account-level-firewall-events/
<p>Cloudflare Logpush now supports <a href="https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/firewall_events/">firewall events as an account-scoped dataset</a>. Configure a single Logpush job at the account level to receive firewall events for every zone in the account, instead of creating and maintaining a separate job per zone.</p> <p>The dataset includes a new <a href="https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/firewall_events/#zonename"><code>ZoneName</code></a> field so you can identify which zone each event came from when consuming logs in your downstream pipeline.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="whats-available">What's available</h4><a class="anchor-link" href="#whats-available"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <ul> <li>A new account-scoped <code>firewall_events</code> dataset, configurable via the <a href="https://developers.cloudflare.com/api/resources/logpush/subresources/jobs/">Logpush API</a> or the Cloudflare dashboard.</li> <li>The same fields and filter expressions supported by the existing <a href="https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/firewall_events/">zone-scoped firewall events dataset</a>, plus the new <code>ZoneName</code> field.</li> <li>Support for all existing Logpush destinations.</li> </ul>
The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.