Edge-log connectors
See the AI agents your CDN or WAF is blocking — connect Cloudflare, Akamai, AWS WAF, Imperva, Vercel or Fastly security logs to Visit Intelligence.
Your CDN's firewall and bot rules run before any code you deploy, including the AstraSync edge adapter and SDK. A request your edge blocks never reaches AstraSync. An edge-log connector reads your edge's own security events (blocked and challenged requests only) so Visit Intelligence and the Agent Traffic Audit can show the agents being turned away.
Set up
- Open the endpoint for your site and find Edge logs.
- Pick your CDN or WAF and press Connect edge logs.
- Copy the receiver URL and the ingest token. The token is shown once; New token replaces it and the old one stops working immediately.
- Follow the steps shown on the card in your CDN or WAF console (summarised below), then press Test.
Rows appear in Visit Intelligence as Blocked at your edge within a few minutes of your edge delivering them.
By provider
| Provider | Where you configure it | What to send | What the logs include |
|---|---|---|---|
| Cloudflare (Enterprise) | Logpush → HTTP destination, authenticated with the token as an Authorization header | Dataset Firewall events, filtered to block and challenge actions | IP, country, ASN, rule, bot source. No request headers |
| Akamai | DataStream 2 → Security logs (SIEM) → custom HTTPS endpoint, Authorization: Bearer <token> | Security events from the security configurations you choose | Request headers, rule actions and messages, Bot Manager names, geo, ASN |
| AWS WAF (CloudFront, ALB) | Amazon Data Firehose → HTTP endpoint, the token as the Firehose access key; web ACL logging → that stream | A logging filter keeping BLOCK, CAPTCHA, CHALLENGE | Request headers, Bot Control labels, JA3 + JA4 |
| Imperva Cloud WAF | SIEM log integration → an S3 bucket you own (CEF); grant AstraSync read access with a role (the card shows the account and ExternalId) | Cloud WAF security events | IP, country, client classification and client app, rule |
| Vercel | Log drain with source Firewall, Authorization: Bearer <token> header | Firewall events | IP, rule, JA4 (with BotID) |
| Fastly | HTTPS logging endpoint, Authorization: Bearer <token>, JSON lines in the documented format | Requests your Next-Gen WAF or bot rules blocked or challenged | Whatever your log format includes |
What is kept
- Kept: blocked requests your WAF judged automated, requests we can attribute to an agent platform from any signal, and requests that presented agent credentials.
- Not kept: requests from people blocked for other reasons (a geo or IP rule, a generic attack signature). Their addresses aren't ours to store.
- Kept rows follow the same retention and daily limits as other visit reports. The card shows how many rows were recorded and how many were not kept.
What it can and can't tell you
- A blocked request never reached AstraSync, so it is classified, not verified: platform names come from fingerprints and from your WAF's own bot names.
- Requests that presented agent credentials but were blocked are the clearest missed opportunities. The agent was identifying itself.
- Without a connector, blocked-at-edge reads not measured, never zero.
- Platform-managed hosting without its own WAF logs (Railway, Render, Fly, Heroku) has nothing to connect.
Letting good agents through
The usual next step is a rule on your edge that lets requests carrying verifiable agent credentials through to AstraSync instead of blocking them, while your WAF keeps blocking everything else. AstraSync then verifies them and applies your policy. See the Trusted Agent Gateway for observe and enforce modes.