Metrics & Logging

Aggregate metrics and per-request logs for the Bunny Shield WAF Engine. Review them regularly to catch false positives and confirm that threats are being blocked.

Bunny Shield provides security metrics and detailed event logs to help you understand how Shield is handling your traffic, investigate suspicious activity, identify false positives, and fine-tune your security configuration.

Metrics

Metrics provide an aggregated view of traffic and security activity across your Shield Zone.

You can use metrics to understand request volumes, monitor triggered security rules, and identify changes or unusual patterns that may require further investigation.

Available WAF metrics include:

• Total processed requests
• Total triggered rules
• Triggered rules that were logged
• Triggered rules that were blocked

Use these metrics to identify trends and anomalies, then investigate individual events using Event Logs.

For API access, see the Metrics API reference.

Event Logs

Event Logs provide a detailed view of security events generated by Bunny Shield, including events from:

• Bot Detection
• Access Lists
• WAF
• Upload Scanning
• API Guardian
• Rate Limiting

Rather than reviewing events individually, you can filter and group logs to investigate activity across your traffic and identify related requests or patterns.

Filter events

Narrow down your investigation using one or more filters:

• Feature
• Action
• Rule ID
• IP address or range
• Country
• ASN
• JA4 fingerprint
• User-Agent
• URL

Filters can be combined to focus on specific traffic. For example, you could investigate requests from a particular ASN that triggered a WAF rule, or isolate activity associated with a specific JA4 fingerprint.

Group events

Group Event Logs by the same attributes to identify patterns across multiple requests.

You can combine multiple fields when grouping events. For example, grouping by IP address, User-Agent, and JA4 fingerprint can help identify requests that share common network, client, and TLS characteristics.

This makes it easier to investigate repeated or coordinated activity without manually comparing individual requests.

Investigate across multiple days

Event Logs are retained for 3 days and can be investigated across multiple days in a single view.

This is useful when investigating activity that spans a longer period rather than reviewing each day separately.

Export event data

You can export Event Logs as a CSV file for further investigation, analysis, or correlation with data from other systems.

For programmatic access to Event Logs, see the Event Logs API reference.