Edge telemetry is data about network traffic observed at an organization’s perimeter, often by a content delivery network (CDN), web application firewall (WAF), or other edge service. It can include request timestamps, source addresses, URLs, headers, and whether traffic was blocked or allowed.
During cyber attacks, edge telemetry can reveal scanning surges or requests matching known exploit patterns, helping defenders prioritize investigation and filtering. However, it shows what reached the perimeter-not necessarily what happened on the server. A request may be blocked, hit a patched system, or come from a defensive scanner. Confirming exploitation requires correlating edge records with origin-side evidence, such as application and system logs, process activity, or unexpected outbound connections.