[WAF] Enumerate Served by Cloudflare triggers in Security Analytics

src/content/docs/cache/performance-review/cache-analytics.mdx

@@ -47,6 +47,10 @@ The **Requests summary** graph shows how your traffic changes over time, such as
 
 **Served by Cloudflare** indicates content served by Cloudflare that did not require contacting your origin web server. **Served by Origin** indicates traffic served from the origin web server.
 
+:::tip
+In Cache Analytics, **Served by Cloudflare** is almost always cache hits. More broadly, the same classification also covers Workers responses, [URL forwarding](/rules/url-forwarding/) redirects, and `/cdn-cgi/` endpoints. For the full list, refer to [Security Analytics — Request activity](/waf/analytics/security-analytics/#request-activity).
+:::
+
 Revalidated requests — where Cloudflare checks with your origin to confirm cached content is still current — are counted differently depending on the view. In the **Data Transfer** view, revalidated requests count as **Served by Cloudflare** because the response body is served from cache, not re-downloaded from the origin. In the **Requests** view, revalidated requests count as **Served by Origin** because Cloudflare still contacts the origin server to verify the content.
 
 **Cache status** graphs break down why traffic is served from Cloudflare versus the origin web server, organized by content type.

src/content/docs/fundamentals/reference/cdn-cgi-endpoint.mdx

@@ -10,6 +10,10 @@ When you [add a domain to Cloudflare](/fundamentals/manage-domains/add-site/), C
 
 This endpoint is managed and served by Cloudflare. It cannot be modified or customized. The endpoint is not used by every Cloudflare product, but you may find some products use the endpoint in its URL.
 
+:::note
+Traffic to `/cdn-cgi/` endpoints is classified as **Served by Cloudflare** in [Security Analytics](/waf/analytics/security-analytics/#request-activity).
+:::
+
 A few examples include (but are not limited to):
 
 * [Identify the Cloudflare data center serving your request](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#identify-the-cloudflare-data-center-serving-your-request), which is helpful for troubleshooting (`https://<YOUR_DOMAIN>/cdn-cgi/trace`).

src/content/docs/waf/analytics/security-analytics.mdx

@@ -122,7 +122,11 @@ The main chart displays the following data for the selected time frame, accordin
 
 - **Traffic analysis**: Traffic mitigated by the Cloudflare security platform, served by Cloudflare, and served by the origin server, according to the following classification:
   - **Mitigated by WAF**: Requests blocked or [challenged](/cloudflare-challenges/challenge-types/challenge-pages/#actions) by Cloudflare's application security products such as the WAF and HTTP DDoS protection. Requests with _Log_, _Skip_, or _Allow_ [actions](/ruleset-engine/rules-language/actions/) are not counted as mitigated.
-  - **Served by Cloudflare**: Requests served by the Cloudflare global network such as cached content and redirects.
+  - **Served by Cloudflare**: HTTP requests served by the Cloudflare network without reaching the origin server. This includes:
+    - Cache hits — Responses served from Cloudflare's [cache](/cache/).
+    - Redirects — Responses generated by [URL forwarding](/rules/url-forwarding/) products such as Redirect Rules, Bulk Redirects, and Dynamic Redirects.
+    - `/cdn-cgi/` endpoints — Requests to the Cloudflare-managed [`/cdn-cgi/` endpoint](/fundamentals/reference/cdn-cgi-endpoint/), used by products such as Bot Management JavaScript detections, Image Transformations, and email address obfuscation.
+    - Workers — Responses returned by a [Cloudflare Worker](/workers/) running on the zone without making an origin subrequest.
   - **Served by origin**: Requests served by your origin server.
 
 - **Attack analysis**: [WAF attack score](/waf/detections/attack-score/) analysis of incoming requests, classifying them as _Clean_, _Likely clean_, _Likely attack_, or _Attack_.