Traffic detections

Traffic detections check incoming requests for malicious, potentially malicious, or non-conforming activity. Each enabled detection scores or classifies requests by populating one or more fields. These fields appear as filters in the Security Analytics dashboard, and you can use them in rule expressions.

Detections are always on once enabled, even if you have not configured any security rules that use them. You can review detection results in Security Analytics to identify traffic patterns and spot potentially malicious traffic. For example, you can analyze traffic based on attack score, bot score, content scan results, or the presence of personally identifiable information (PII) in large language model (LLM) prompts.

Application Profiles compare requests with application-specific expected structures. Profile detections do not mitigate traffic without a security rule.

Cloudflare provides the following detections:

• WAF attack score
• Leaked credentials detection
• Malicious uploads detection
• AI Security for Apps
• Bot score
• Threat intelligence
• Application Profiles

For more information on bot score, refer to Bot scores.

For detections managed through Security settings:

Detections enabled through Security settings run for all incoming traffic. Application Profiles instead evaluate requests after a learned or uploaded profile becomes available.

For more information on detection versus mitigation, refer to Concepts.