Cloudflare.MagicNetworkMonitoring reference

Config

Source: src/Cloudflare/MagicNetworkMonitoring/Config.ts

The Magic Network Monitoring (MNM) account configuration — the singleton that registers your network’s routers (and optionally WARP devices) as flow-data sources and sets the fallback packet sampling rate.

There is exactly one MNM configuration per Cloudflare account, and MNM rules cannot be created until it exists. Creating a second configuration fails (MnmConfigAlreadyExists), so reconcile tolerates the race by falling through to an update. When the engine has no prior state but a configuration already exists on the account, read reports it as Unowned and takeover is gated behind --adopt.

Config: Creating the configuration

Minimal configuration

const config = yield* Cloudflare.MagicNetworkMonitoring.Config("Mnm", {
  name: "my-network",
  defaultSampling: 1,
});

Configuration with router IPs

const config = yield* Cloudflare.MagicNetworkMonitoring.Config("Mnm", {
  name: "my-network",
  defaultSampling: 100,
  routerIps: ["203.0.113.1/32"],
});

Config: Rules depend on the configuration

const config = yield* Cloudflare.MagicNetworkMonitoring.Config("Mnm", {
  name: "my-network",
  defaultSampling: 1,
});
// Reference an output attribute so the rule deploys after the config.
yield* Cloudflare.MagicNetworkMonitoring.Rule("VolumetricAlert", {
  accountId: config.accountId,
  type: "threshold",
  prefixes: ["10.0.0.0/24"],
  bandwidthThreshold: 1_000_000,
});

Rule

Source: src/Cloudflare/MagicNetworkMonitoring/Rule.ts

A Magic Network Monitoring (MNM) rule — alerts when traffic to a set of IPv4 prefixes exceeds a static threshold (threshold), deviates from the learned baseline (zscore), or matches advanced DDoS criteria (advanced_ddos, Magic Transit only).

Rules require the account’s MNM configuration to exist first — pass the Config resource’s accountId output as this rule’s accountId to sequence the deployment. Rule names are unique per account; the rule type is immutable and changing it triggers a replacement.

Rule: Threshold rules

Alert when bandwidth exceeds 1 Mbps for 5 minutes

const config = yield* Cloudflare.MagicNetworkMonitoring.Config("Mnm", {
  name: "my-network",
  defaultSampling: 1,
});
yield* Cloudflare.MagicNetworkMonitoring.Rule("BandwidthAlert", {
  accountId: config.accountId,
  type: "threshold",
  prefixes: ["10.0.0.0/24"],
  bandwidthThreshold: 1_000_000,
  duration: "5m",
});

Packet-rate alert

yield* Cloudflare.MagicNetworkMonitoring.Rule("PacketAlert", {
  accountId: config.accountId,
  type: "threshold",
  prefixes: ["10.0.1.0/24"],
  packetThreshold: 10_000,
});

Rule: Anomaly detection

yield* Cloudflare.MagicNetworkMonitoring.Rule("AnomalyAlert", {
  accountId: config.accountId,
  type: "zscore",
  prefixes: ["10.0.2.0/24"],
  zscoreSensitivity: "medium",
  zscoreTarget: "bits",
});