Skip to content
Cloudflare API
Start here
API Reference
Radar
Attacks
Layer3

Get layer 3 attacks time series grouped by dimension

client.radar.attacks.layer3.timeseriesGroupsV2("PROTOCOL" | "IP_VERSION" | "VECTOR" | 4 moredimension, Layer3TimeseriesGroupsV2Params { aggInterval, continent, dateEnd, 10 more } query?, RequestOptionsoptions?): Layer3TimeseriesGroupsV2Response { meta, serie_0 }
GET/radar/attacks/layer3/timeseries_groups/{dimension}

Retrieves the distribution of layer 3 attacks grouped by dimension over time.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
User Details WriteUser Details Read
ParametersExpand Collapse
dimension: "PROTOCOL" | "IP_VERSION" | "VECTOR" | 4 more

Specifies the attribute by which to group the results.

One of the following:
"PROTOCOL"
"IP_VERSION"
"VECTOR"
"DURATION"
"BITRATE"
"VERTICAL"
"INDUSTRY"
query: Layer3TimeseriesGroupsV2Params { aggInterval, continent, dateEnd, 10 more }
aggInterval?: "15m" | "1h" | "1d" | "1w"

Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals. When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

One of the following:
"15m"
"1h"
"1d"
"1w"
continent?: Array<string>

Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude continents from results. For example, -EU,NA excludes results from EU, but includes results from NA.

dateEnd?: Array<string>

End of the date range (inclusive). Alternative to dateRange; provide together with dateStart. When requesting comparison series, every series must resolve to the same duration as the main series. Each dateStart/dateEnd is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

dateRange?: Array<string>

Filters results by relative date range ending at the current time, with each value producing a separate series. Use <n>d for days (up to 364d) or <n>w for weeks (up to 52w). Append control to request the equivalent previous period for comparison: the comparison window is shifted back by the current window’s length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. 7dcontrol covers days -14 to -7, 10dcontrol covers days -24 to -14). For example, pass 7d and 7dcontrol to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including control) satisfy this automatically. Use this parameter or set specific start and end dates (dateStart and dateEnd parameters).

dateStart?: Array<string>

Start of the date range. Alternative to dateRange; provide together with dateEnd. When requesting comparison series, every series must resolve to the same duration as the main series. Each dateStart/dateEnd is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

direction?: "ORIGIN" | "TARGET"

Specifies whether the location filter applies to the source or target location.

One of the following:
"ORIGIN"
"TARGET"
format?: "JSON" | "CSV"

Format in which results will be returned.

One of the following:
"JSON"
"CSV"
ipVersion?: Array<"IPv4" | "IPv6">

Filters results by IP version (Ipv4 vs. IPv6).

One of the following:
"IPv4"
"IPv6"
limitPerGroup?: number

Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an “other” category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2.

location?: Array<string>

Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude locations from results. For example, -US,PT excludes results from the US, but includes results from PT.

name?: Array<string>

Array of names used to label the series in the response.

normalization?: "PERCENTAGE" | "MIN0_MAX"

Normalization method applied to the results. Refer to Normalization methods.

One of the following:
"PERCENTAGE"
"MIN0_MAX"
protocol?: Array<"UDP" | "TCP" | "ICMP" | "GRE">

Filters the results by layer 3/4 protocol.

One of the following:
"UDP"
"TCP"
"ICMP"
"GRE"
ReturnsExpand Collapse
Layer3TimeseriesGroupsV2Response { meta, serie_0 }
meta: Meta { aggInterval, confidenceInfo, dateRange, 3 more }

Metadata for the results.

aggInterval: "FIFTEEN_MINUTES" | "ONE_HOUR" | "ONE_DAY" | 2 more

Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals.

One of the following:
"FIFTEEN_MINUTES"
"ONE_HOUR"
"ONE_DAY"
"ONE_WEEK"
"ONE_MONTH"
confidenceInfo: ConfidenceInfo { annotations, level }
annotations: Array<Annotation>
dataSource: "ALL" | "AI_BOTS" | "AI_GATEWAY" | 22 more

Data source for annotations.

One of the following:
"ALL"
"AI_BOTS"
"AI_GATEWAY"
"BGP"
"BOTS"
"CONNECTION_ANOMALY"
"CT"
"DNS"
"DNS_MAGNITUDE"
"DNS_AS112"
"DOS"
"EMAIL_ROUTING"
"EMAIL_SECURITY"
"FW"
"FW_PG"
"HTTP"
"HTTP_CONTROL"
"HTTP_CRAWLER_REFERER"
"HTTP_ORIGINS"
"IQI"
"LEAKED_CREDENTIALS"
"NET"
"ROBOTS_TXT"
"SPEED"
"WORKERS_AI"
description: string
endDate: string
formatdate-time
eventType: "EVENT" | "GENERAL" | "OUTAGE" | 3 more

Event type for annotations.

One of the following:
"EVENT"
"GENERAL"
"OUTAGE"
"PARTIAL_PROJECTION"
"PIPELINE"
"TRAFFIC_ANOMALY"
isInstantaneous: boolean

Whether event is a single point in time or a time range.

linkedUrl: string
formaturi
startDate: string
formatdate-time
tags?: Array<string>
level: number

Provides an indication of how much confidence Cloudflare has in the data.

dateRange: Array<DateRange>
endTime: string

Adjusted end of date range.

formatdate-time
startTime: string

Adjusted start of date range.

formatdate-time
lastUpdated: string

Timestamp of the last dataset update.

formatdate-time
normalization: "PERCENTAGE" | "MIN0_MAX" | "MIN_MAX" | 5 more

Normalization method applied to the results. Refer to Normalization methods.

One of the following:
"PERCENTAGE"
"MIN0_MAX"
"MIN_MAX"
"RAW_VALUES"
"PERCENTAGE_CHANGE"
"ROLLING_AVERAGE"
"OVERLAPPED_PERCENTAGE"
"RATIO"
units: Array<Unit>

Measurement units for the results.

name: string
value: string
serie_0: Serie0 { timestamps }
timestamps: Array<string>

Get layer 3 attacks time series grouped by dimension

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.radar.attacks.layer3.timeseriesGroupsV2('PROTOCOL');

console.log(response.meta);
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}
Returns Examples
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}