Cloudflare Gateway Network Intelligence connector

The Cloudflare Gateway Network Intelligence connector reads your account’s Gateway DNS analytics every minute. It counts how often your users resolved each domain, and how often Gateway blocked it, for Network Intelligence.

This connector only reads. To block lookalike domains in Gateway, use the Cloudflare Zero Trust connector with a rule.

Prerequisites

• A Cloudflare account with Zero Trust set up and DNS queries going through Gateway, from devices running the Cloudflare One client or from a Gateway DNS location.
• The Network Intelligence add-on.

Setup

1. In Cloudflare, go to Manage Account > API Tokens and create a token with the Account Analytics: Read permission for the account.
2. Copy your Account ID from the overview page of the Cloudflare dashboard.
3. In the app, open Connectors > Cloudflare Gateway Network Intelligence.
4. Paste the Account ID and the token value, then select Connect account.

Before saving, the connector runs one analytics query for the last hour to confirm the token can read the account. The token is never shown again. The page shows its last four characters.

A separate, read-only token

Account Analytics: Read only reads analytics. It’s separate from the Zero Trust: Write token that the Cloudflare Zero Trust blocking connector uses. Neither connector needs the other’s token.

What it reads

The connector reads Gateway DNS analytics through the Cloudflare GraphQL Analytics API, grouped by hour, query name, and resolver decision. For each hour and destination, it stores:

• Hits: DNS queries for the destination and its subdomains.
• Allowed hits and blocked hits: queries Gateway allowed or blocked. Queries with any other resolver decision, such as an override, count as hits only.
• Hosts: a sample of the query names under the destination.

Records have the dns kind and the cloudflare_gateway provider.

Device names, user names, and source addresses are never read.

Counts are estimates in busy accounts

Cloudflare samples analytics in busy accounts, so counts can differ from Gateway’s logs. A rarely queried domain can be missing from a sampled hour.

Schedule

• Every minute, the connector reads the current and previous hour.
• Every 10 minutes, it reads the last three hours.

Each read replaces the counts for the hours it covers. Network rules evaluate each new record as it lands.

Status

The connector page shows the account ID, the token’s last four characters, when it was connected, and the latest successful and failed runs. When a run fails, it names the cause:

Failure	Meaning
Authorization	Cloudflare rejected the token. It was deleted, rolled, or expired. Replace it.
Permission	The token can’t read this account’s analytics. Create a token with Account Analytics: Read for this account.
Provisioning	Gateway DNS analytics aren’t available. Check that Zero Trust is set up on the account.
Rate limited	Cloudflare rate-limited analytics queries for the token. The next run retries.
Provider unavailable or network	The Cloudflare API was unavailable or unreachable. The next run retries.

To rotate the token, select Replace token and paste the new value.

Disconnecting

Disable pauses ingestion and keeps the connection. Disconnect stops ingestion and deletes the stored token. Counts already stored stay until retention removes them after 90 days.

The token stays active in Cloudflare. Delete it there if nothing else uses it.