cf_baseline_traffic_diff
Compare traffic from an attack window against a prior baseline on the same path to identify anomalies in edge response status and client country distributions.
Instructions
Compare attack-window traffic vs a prior baseline window on the same path.
Runs two `httpRequestsAdaptiveGroups` queries grouped by
`edgeResponseStatus` and `clientCountryName`, returning a side-by-side
diff suitable for the ATK archetype workflow.
Args:
zone_id: zone tag.
match_path: exact `clientRequestPath` to filter (e.g. '/oauth/token').
attack_since, attack_until: ISO-8601 attack window.
baseline_lookback_days: how many days before `attack_since` to align
the baseline window (defaults to 7).
Calls: POST /graphql, two httpRequestsAdaptiveGroups queries.
Returns: envelope with `data = {attack: {...}, baseline: {...},
window_seconds: N, zone_id, match_path}`.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| zone_id | Yes | ||
| match_path | Yes | ||
| attack_since | Yes | ||
| attack_until | Yes | ||
| baseline_lookback_days | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |