Skip to content
Analytics
Visit Analytics on GitHub
Set theme to dark (⇧+D)

Querying Firewall Events with GraphQL

In this example, we're going to use the GraphQL Analytics API to query for Firewall Events over a specified time period.

The following API call will request Firewall Events over a one hour period, and output the requested fields. Be sure to replace CLOUDFLARE_ZONE_ID, CLOUDFLARE_EMAIL, and CLOUDFLARE_API_KEY with your zone tag and API credentials, and adjust the datetime_geg and datetime_leq values to your liking.

API Call

PAYLOAD='{ "query":  "query ListFirewallEvents($zoneTag: string, $filter: FirewallEventsAdaptiveFilter_InputObject) {      viewer {        zones(filter: { zoneTag: $zoneTag }) {          firewallEventsAdaptive(            filter: $filter            limit: 10            orderBy: [datetime_DESC]          ) {            action            clientAsn            clientCountryName            clientIP            clientRequestPath            clientRequestQuery            datetime            source            userAgent          }        }      }    }",    "variables": {      "zoneTag": "CLOUDFLARE_ZONE_ID",      "filter": {        "datetime_geq": "2020-04-24T11:00:00Z",        "datetime_leq": "2020-04-24T12:00:00Z"      }    }  }'
curl \  -X POST \  -H "Content-Type: application/json" \  -H "X-Auth-Email: CLOUDFLARE_EMAIL" \  -H "X-Auth-key: CLOUDFLARE_API_KEY" \  --data "$(echo $PAYLOAD)" \  https://api.cloudflare.com/client/v4/graphql/

The results returned will be in JSON (as requested), so piping the output to jq will make them easier to read, e.g.,:

curl \  -X POST \  -H "Content-Type: application/json" \  -H "X-Auth-Email: CLOUDFLARE_EMAIL" \  -H "X-Auth-key: CLOUDFLARE_API_KEY" \  --data "$(echo $PAYLOAD)" \  https://api.cloudflare.com/client/v4/graphql/ | jq .{  "data": {    "viewer": {      "zones": [        {          "firewallEventsAdaptive": [            {              "action": "log",              "clientAsn": "5089",              "clientCountryName": "GB",              "clientIP": "203.0.113.69",              "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:11:24Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"            },            {              "action": "log",              "clientAsn": "5089",              "clientCountryName": "GB",              "clientIP": "203.0.113.69",              "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:11:24Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"            },            {              "action": "log",              "clientAsn": "5089",              "clientCountryName": "GB",              "clientIP": "203.0.113.69",              "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:11:24Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"            },            {              "action": "log",              "clientAsn": "5089",              "clientCountryName": "GB",              "clientIP": "203.0.113.69",              "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:11:24Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"            },            {              "action": "log",              "clientAsn": "5089",              "clientCountryName": "GB",              "clientIP": "203.0.113.69",              "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:11:24Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"            },            {              "action": "log",              "clientAsn": "5089",              "clientCountryName": "GB",              "clientIP": "203.0.113.69",              "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:11:24Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"            },            {              "action": "log",              "clientAsn": "5089",              "clientCountryName": "GB",              "clientIP": "203.0.113.69",              "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:11:24Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"            },            {              "action": "drop",              "clientAsn": "5089",              "clientCountryName": "GB",              "clientIP": "203.0.113.69",              "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:11:24Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"            },            {              "action": "log",              "clientAsn": "58224",              "clientCountryName": "IR",              "clientIP": "2.183.175.37",              "clientRequestPath": "/api/v2",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:00:54Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"            },            {              "action": "log",              "clientAsn": "58224",              "clientCountryName": "IR",              "clientIP": "2.183.175.37",              "clientRequestPath": "/api/v2",              "clientRequestQuery": "",              "datetime": "2020-04-24T10:00:54Z",              "source": "waf",              "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"            }          ]        }      ]    }  },  "errors": null}