Edge and application telemetry

Good detection starts with good data: a pipeline that receives traffic from the edge and the application, normalizes, enriches and stores it in a way you can query in seconds.

Cloudflare LogpushBigQueryVectorFluent Bit

What it is

Edge telemetry is the set of events that describe the traffic reaching your application: every request at the CDN and the , with the inspection result, plus the application's own events (login, error, state change). It is the raw material for every detection and every metric.

Without it, the SOC operates blind or depends on ready-made dashboards that answer other people's questions, not yours.

The pipeline, end to end

Thinking in stages helps locate where a problem starts when detection fails:

Ingestion: delivery of logs in batch or streaming from the edge (for example, a log push service) and from the application.
Normalization: a single field schema (timestamp, IP, path, method, status, user agent, WAF result), regardless of source.
Enrichment: ASN, country, reputation, bot score, account identifier, application version.
Storage: tables partitioned by time, designed for querying by window.
Detection: queries and rules over the data (the subject of the detection engineering topic).
Action and metric: the result becomes a block, an alert or an indicator, and returns to the pipeline to close the loop.

A normalized event

The schema is a contract. When every event has the same fields with the same names, a detection written once works for any source. A lean example:

edge_event.jsonjson

{
  "ts": "2026-10-13T14:03:21.482Z",
  "client_ip": "203.0.113.42",
  "asn": 64500,
  "country": "BR",
  "method": "POST",
  "host": "api.example.com",
  "path": "/api/login",
  "status": 401,
  "user_agent": "python-requests/2.31",
  "bot_score": 8,
  "waf_action": "log",
  "waf_rule": "login-ratelimit-v2",
  "account_id": "u_18273"
}

Data quality

Three problems always show up: missing fields (the detection silently stops working), misaligned clocks (wrong windows) and lost volume (a pipeline that drops events under load). It is worth monitoring the pipeline itself: ingestion latency, count per source and the rate of events missing essential fields. Detection over incomplete data gives false confidence.

WAFweb application firewallAn edge filter that blocks known attack patterns in HTTP. It complements the code: it does not replace fixing the vulnerability, it only buys time.see in glossary →

connections on the map

Edge and application telemetryrevealsL7 attacks: what to look for
Edge and application telemetryfeedsDetection engineering
Scale: telemetry, cardinality and costsustainsEdge and application telemetry

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Log analysis and building a timelineresponseyou can only reconstruct what was collected
Observability: metrics, logs and tracesdevopsthe same telemetry discipline, for platform and for security
Logging & detection - signals and alertscloudsecsame idea of signal, applied to L7 traffic

Unlocks

test what you learned

Loading questions…