Checking firewall events via API

[atomic compass]

I want to check firewall events using the api (the ones that appear on the security tab), I am mainly interested in the number of events in a given time, how could I do this and what is the minimum time period I can check?

[tardy elk]

Its part of the GraphQL API: https://developers.cloudflare.com/analytics/graphql-api/tutorials/querying-firewall-events/

[atomic compass]

Tysm, what is the minimum time period? And how could I see the amount of events on that time period?
I have been experiencing DDoS, and I want to make a script that can check every 10 seconds for example how many events occurred in the last 10 seconds, and if a lot of events occurred, activate UAM automatically for a specific period of time, it would be great to see this as a feature though

[tardy elk]

Minimum time period - like 1 minute I think? Maximum is 24 hours unless you have Business (72 hours) or Enterprise (30 days)
and it will return the total amount, yes:

[atomic compass]

Perfect, Tysm

[tardy elk]

If you have skip rules setup with logging enabled then make sure to filter out the Skip actions or you'll get good traffic mixed up in the total

[tardy elk]

If youre really sneaky on the dashboard you can look at the browser network log to see what queries it sends

for last 30 minutes of security events excluding Skip it does some complex query like this (replace account and zone tags with your own)

reupload in pretty print

datetime_geq and datetime_leq need adjustment as well as account and zone tags

[atomic compass]

But there is more than one datetime thing

[tardy elk]

yeah

I'm not a GraphQL expert so I don't know why 😄 the queries from the dashboard are scary, you may have better luck making your own if you know what youre doing

[atomic compass]

I will, thank you for your help

[atomic compass]

There is a problem

What is the time from a log being made to it showing on the api?

[tardy elk]

Between 1-3 minutes from my experience

[atomic compass]

Uhm

That’s not very good

[tardy elk]

Its not designed to be used as realtime logs 🙂

[atomic compass]

Is there any way to make it faster?

[atomic compass]

And what is?

[tardy elk]

No

[tardy elk]

You need Business or Enterprise https://developers.cloudflare.com/logs
Instant Logs through a websocket is the most realtime of them all

[atomic compass]

Oh :c

[atomic compass]

Isn’t there any other way without business or enterprise?

[tardy elk]

No, the only other way to get events is through the GraphQL Analytics API which has a short delay as its not designed for realtime use