Focus on timestamp, client IP, status code, user agent, and any bot detection scores your CDN provides. Geographic data helps identify attack origins, while cache outcomes can reveal content scanning attempts. Start minimal and add fields based on actual security incidents you encounter.