---
title: "Area 1"
slug: "area-1"
tags: ["Self Service Ingestion"]
updated: 2026-03-09T17:56:31Z
published: 2026-03-09T18:00:22Z
canonical: "docs.hunters.ai/area-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Area 1

****TL;DR****

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Area 1 Alerts | ✅ |  | ✅ |  | areaone_alerts | NDJSON | API |
| Area 1 Indicators |  |  | ✅ |  | areaone_indicators | NDJSON | API |

---

## Overview

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/65415ae-image.png)Cloudflare Area 1, recently merged into Cloudflare, comprehensively defends against sophisticated threats by stopping phish at the earliest stages of the attack cycle.

Integrating Area 1 into Hunters allows the collection and ingestion of key data types into the data lake. Furthermore, alerts will be created over the logs, auto-investigated and correlated to other related signals.

## Supported data types

### Area 1 Alerts

**Table name:** `areaone_alerts`

Email alerts generated by Area 1.

### Area 1 Indicators

**Table name:** `areaone_indicators`

Indicators reported by Area 1.

## Send data to Hunters

Hunters support API collection for Area 1 events.

**To connect Area 1 logs:**

1. Navigate to **API Authentication and Authorization** section and follow [this](https://developers.cloudflare.com/email-security/api/) guide to gather the following API keys from Area 1:
  - `Public Key`
  - `Private Key`
2. Complete the process on the Hunters platform, following [this guide](https://hunters.document360.io/docs/connect-a-data-source).

## Expected format

### Area 1 Alerts sample

```plaintext
{ "source": "area1security", "time": 1678348978033, "event": { "final_disposition": "MALICIOUS", "delivery_mode": "DIRECT", "attachments": [ { "sha1": "123", "sha256": "123", "content_type_provided": "image/jpeg", "content_type_computed": "image/jpeg", "name": "image003.jpg", "ssdeep": "48:lX6uERAL3EZ+XRjeG7tma95wp5RQf/gMo/123:l9EMg+123", "md5": "123", "extension": "jpg", "att_size": 123456 } ], "smtp_helo_server_name": "mail.example.net", "envelope_to": [ "user@example.com" ], "subject": "Potential Partnership", "smtp_helo_server_ip_as_name": "LIQUIDWEB - Liquid Web, L.L.C, US", "alert_reasons":["Malicious previous hop domain server 'mail.example[dot]net'","no really, it's a very mailicious domain 'example[dot]net'"], "encrypted_feature_count": null, "message_id": "<123$123$123$@example.com.ph>", "replyto_name": null, "from_name": "Christine", "smtp_helo_server_ip": "192.168.1.184", "smtp_helo_server_ip_geo": "US/-/-", "smtp_helo_server_ip_as_number": "3232235960", "envelope_from": "christine@example.com", "alert_id": "123-2022-04-24T04:41:19", "replyto": "christine@example.com.ph", "from": "CEO Christine <christine@example.com.ph>", "to": [ "user@example.com" ], "links": [ "http://123.com/badlink", "http://another-malicious-link.xyz/" ], "ts": "2022-04-24T04:41:19Z" } }
```

### Area 1 Indicators sample

```plaintext
{"item_name": "123", "first_seen": 1679294444759, "threat_name": "Area 1 Identified Malicious", "threat_categories": [{"classification_disposition": ["Unclassified"], "threat_type": ["Threat Type1"], "category": ["Category1"]}], "last_seen": 1679294444759, "item_type": "filehash"}
```