Content security rule violations

A rule violation occurs when a browser loads a resource that is not covered by one of your content security rules. For log rules, the resource loads normally but is reported. For allow rules, the browser blocks the resource.

Shortly after you configure content security rules, the Cloudflare dashboard will start displaying any violations of those rules. This information is available for rules with any action (Allow and Log).

Information about rule violations is also available via GraphQL API and Logpush.

To view rule violation information:

1. In the Cloudflare dashboard, go to the Security rules page.

   Go to Security rules ↗

2. (Optional) Filter by Content security rules.

The displayed information includes the following:

• A sparkline next to the rule name, showing violations in the past seven days.
• For content security rules with associated violations, an expandable details section for each rule, with the top resources present in violation events and a sparkline per top resource.

Use the Cloudflare GraphQL API to obtain rule violation information through the following dataset:

• pageShieldReportsAdaptiveGroups

You can query the dataset for rule violations that occurred in the past 30 days.

Use introspection to explore the available fields the GraphQL schema. For more information, refer to Explore the GraphQL schema.

For an introduction to GraphQL querying, refer to Querying basics.

query PageShieldReports(
	$zoneTag: string
	$datetimeStart: Time
	$datetimeEnd: Time
) {
	viewer {
		zones(filter: { zoneTag: $zoneTag }) {
			pageShieldReportsAdaptiveGroups(
				limit: 100
				orderBy: [datetime_ASC]
				filter: { datetime_geq: $datetimeStart, datetime_leq: $datetimeEnd }
			) {
				avg {
					sampleInterval
				}
				count
				dimensions {
					policyID
					datetime
					datetimeMinute
					datetimeFiveMinutes
					datetimeFifteenMinutes
					datetimeHalfOfHour
					datetimeHour
					url
					urlHost
					host
					resourceType
					pageURL
					action
				}
			}
		}
	}
}

echo '{ "query":
  "query PageShieldReports($zoneTag: string, $datetimeStart: string, $datetimeEnd: string) {
    viewer {
      zones(filter: {zoneTag: $zoneTag}) {
        pageShieldReportsAdaptiveGroups(limit: 100,  orderBy: [datetime_ASC], filter: {datetime_geq:$datetimeStart, datetime_leq:$datetimeEnd}) {
          avg {
            sampleInterval
          }
          count
          dimensions {
            policyID
            datetime
            datetimeMinute
            datetimeFiveMinutes
            datetimeFifteenMinutes
            datetimeHalfOfHour
            datetimeHour
            url
            urlHost
            host
            resourceType
            pageURL
            action
          }
        }
      }
    }
  }",
  "variables": {
    "zoneTag": "<CLOUDFLARE_ZONE_ID>",
    "datetimeStart": "2023-04-17T11:00:00Z",
    "datetimeEnd": "2023-04-24T12:00:00Z"
  }
}' | tr -d '\n' | curl --silent \
https://api.cloudflare.com/client/v4/graphql \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--header "Content-Type: application/json" \
--data @-

Cloudflare Logpush supports pushing logs to storage services, SIEM systems, and log management providers.

Information about rule violations is available in the page_shield_events dataset.

For more information on configuring Logpush jobs, refer to Logpush documentation.