> ## Documentation Index
> Fetch the complete documentation index at: https://bunny.net/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Metrics & Logging

> Aggregate metrics and per-request logs for the Bunny Shield WAF Engine. Review them regularly to catch false positives and confirm that threats are being blocked.

Bunny Shield provides security metrics and detailed event logs to help
you understand how Shield is handling your traffic, investigate
suspicious activity, identify false positives, and fine-tune your
security configuration.

## Metrics

Metrics provide an aggregated view of traffic and security activity
across your Shield Zone.

You can use metrics to understand request volumes, monitor triggered
security rules, and identify changes or unusual patterns that may
require further investigation.

Available WAF metrics include:

* Total processed requests
* Total triggered rules
* Triggered rules that were logged
* Triggered rules that were blocked

Use these metrics to identify trends and anomalies, then investigate
individual events using Event Logs.

For API access, see the [Metrics API
reference](https://bunny.net/docs/api-reference/shield/metrics/get-an-overview-of-metrics-for-the-specified-shield-zone.md).

## Event Logs

Event Logs provide a detailed view of security events generated by Bunny
Shield, including events from:

* Bot Detection
* Access Lists
* WAF
* Upload Scanning
* API Guardian
* Rate Limiting

Rather than reviewing events individually, you can filter and group logs
to investigate activity across your traffic and identify related
requests or patterns.

### Filter events

Narrow down your investigation using one or more filters:

* Feature
* Action
* Rule ID
* IP address or range
* Country
* ASN
* JA4 fingerprint
* User-Agent
* URL

Filters can be combined to focus on specific traffic. For example, you
could investigate requests from a particular ASN that triggered a WAF
rule, or isolate activity associated with a specific JA4 fingerprint.

### Group events

Group Event Logs by the same attributes to identify patterns across
multiple requests.

You can combine multiple fields when grouping events. For example,
grouping by **IP address, User-Agent, and JA4 fingerprint** can help
identify requests that share common network, client, and TLS
characteristics.

This makes it easier to investigate repeated or coordinated activity
without manually comparing individual requests.

### Investigate across multiple days

Event Logs are retained for **3 days** and can be investigated across
multiple days in a single view.

This is useful when investigating activity that spans a longer period
rather than reviewing each day separately.

### Export event data

You can export Event Logs as a **CSV file** for further investigation,
analysis, or correlation with data from other systems.

For programmatic access to Event Logs, see the [Event Logs API
reference](https://bunny.net/docs/api-reference/shield/event-logs/search-filter-and-group-event-logs-for-a-shield-zone.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.