aiFObserve
Distributed, Contextual Visibility & Governance for Enterprise AI Traffic. No Agents, No APIs, No
Cloudflare WAF Capture Guide For Unified aiFObserve
Best Capture Source
Use Cloudflare Logpush for the http_requests dataset. Include security and WAF fields in the Logpush job. Cloudflare's HTTP request dataset can also contain AI Security fields such as token count, PII categories, unsafe topic categories, and prompt-injection score when those features are enabled.
Basic Logging
- RayID
- EdgeStartTimestamp, EdgeEndTimestamp
- ClientIP
- ClientSrcPort
- ClientRequestHost
- ClientRequestURI
- ClientRequestMethod
- ClientRequestUserAgent
- ClientRequestBytes
- EdgeResponseBytes
- EdgeResponseStatus
- OriginIP
- SecurityAction or SecurityActions
- SecurityRuleID or SecurityRuleIDs
- SecurityRuleDescription
- ZoneName
Extended Logging
- WAFAttackScore
- WAFSQLiAttackScore, WAFXSSAttackScore, WAFRCEAttackScore
- MatchedRules
- SecuritySources
- ClientCountry, ClientRegionCode, ClientCity
- EdgeColoCode, EdgeColoID
- RequestHeaders, where privacy policy allows identity header capture
- ResponseHeaders, where needed for tenant/app evidence
- AISecurityInjectionScore
- AISecurityPIICategories
- AISecurityTokenCount
- AISecurityUnsafeTopicCategories
User And App Identity
- Cloudflare Access user headers or request headers, if intentionally logged
- application host and URI
- account/zone fields
- user agent
- provider inference from host or path
Avoid logging sensitive authorization headers. Prefer explicit identity headers designed for audit use.
AI Provider And Location Evidence
Keep ClientCountry, ClientRegionCode, EdgeColoCode, OriginIP, ClientRequestHost, and zone/account identifiers. Compliance reports use these fields to show provider, edge, origin, and potential data-boundary evidence.