[WAF] Enumerate Served by Cloudflare triggers in Security Analytics

[zeinjaber]

Tracked by DEE-2812.

[github-actions]

Hey there, we've marked this pull request as stale because there's no recent activity on it. This label helps us identify PRs that might need updates (or to be closed out by our team if no longer relevant).

[github-actions]

Hey there, we've closed out this pull request because it's been stale for a while and there's been no additional action on it. If these changes are still relevant, open a new pull request (or flag to us in a GitHub issue).

[cloudflare-docs-bot]

Review

⚠️ Rebase: Rebase skipped — cannot push to fork branches. The PR author must rebase locally.
⚠️ 2 warnings found in commit e5350c5.

👉 Fix in your agent 👈

Fix the following review findings in PR #30204 (https://github.com/cloudflare/cloudflare-docs/pull/30204).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
  or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.

The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.

---

## Conventions

### Warnings (2)

#### CV-c68116ad5c62 · PR description
- **File:** PR-level finding
- **Issue:** The description is only "Tracked by DEE-2812." and provides no explanation of what the PR does.
- **Fix:** Add a sentence describing the change, such as which "Served by Cloudflare" triggers are enumerated in Security Analytics.

#### CV-46fcb69b43c1 · PR description omits core changes
- **File:** PR-level finding
- **Issue:** The description does not mention any of the PR's changes; the PR also edits cache/performance-review/cache-analytics.mdx (+5) and fundamentals/reference/cdn-cgi-endpoint.mdx (+4), which are not covered by the title's WAF scope.
- **Fix:** Describe the full scope of the PR, including the changes to the cache analytics and cdn-cgi endpoint documentation.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

_{No code review issues found.}

Conventions

Warnings (2)

File	Issue
PR	PR description — The description is only "Tracked by DEE-2812." and provides no explanation of what the PR does. Fix: Add a sentence describing the change, such as which "Served by Cloudflare" triggers are enumerated in Security Analytics.
PR	PR description omits core changes — The description does not mention any of the PR's changes; the PR also edits cache/performance-review/cache-analytics.mdx (+5) and fundamentals/reference/cdn-cgi-endpoint.mdx (+4), which are not covered by the title's WAF scope. Fix: Describe the full scope of the PR, including the changes to the cache analytics and cdn-cgi endpoint documentation.

Style Guide Review

_{No style-guide issues found.}

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

[github-actions]

Hey there, we've closed out this pull request because it's been stale for a while and there's been no additional action on it. If these changes are still relevant, open a new pull request (or flag to us in a GitHub issue).

[zeinjaber]

/rebase

[zeinjaber]

@Oxyjun @elithrar @AdamBouhmad @zaidoon1 @ack-cf @mbullock1986 @KaydeeDee @xmflsct @danielegm - could you please review this PR? Thanks.

[zeinjaber]

/rebase

[zeinjaber]

Rebase failing - created a new PR: #33032