query_security_events
Query Cloudflare security events by zone and time range to retrieve client info, actions, rule details, and bot scores for security event triage.
Instructions
Query security events for a Cloudflare zone using the GraphQL Analytics API. Returns event details including client info, action taken, rule details, bot score, and response status for security event triage.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | Filter by requested HTTP hostname | |
| limit | No | Max number of events to return (default: 100, max: 10000) | |
| action | No | Filter by action taken: block, challenge, jschallenge, managedchallenge, log, allow, bypass, connectionclose | |
| source | No | Filter by mitigation source: firewallManaged, firewallCustom, firewallrules, waf, rateLimit, bic, hot, securitylevel, uablock, ip, iprange, asn, country, zonelockdown, l7ddos, botfight, botmanagement, apishield, apishieldschemavalidation, apishieldtokenvalidation, apishieldsequencemitigation, dlp, validation | |
| country | No | Filter by client country name (e.g. US, JP, CN) | |
| date_to | Yes | required,End datetime in RFC3339 format | |
| rule_id | No | Filter by the rule ID that triggered the event | |
| zone_id | Yes | required,The ID of the zone | |
| client_ip | No | Filter by client IP address | |
| date_from | Yes | required,Start datetime in RFC3339 format (e.g. 2026-03-23T08:19:58Z) | |
| http_method | No | Filter by HTTP request method (e.g. GET, POST) | |
| request_path | No | Filter by HTTP request path |