cf_query_firewall_events_grouped
Group Cloudflare firewall events by dimensions such as action or country within a specified time range. Retrieve aggregated counts with optional filters and pagination.
Instructions
Group firewall events by chosen dimensions over a time window.
Calls: POST /graphql, firewallEventsAdaptiveGroups dataset.
Args:
zone_id: zone tag (32-char hex).
since: RFC 3339 / ISO 8601 start, e.g. '2026-05-28T00:00:00Z'.
until: ISO 8601 end, must be after `since`.
group_by: dimensions to group on (e.g. ['action', 'clientCountryName']).
See _FIREWALL_GROUP_DIMENSIONS for the allowed set.
filters: extra Cloudflare filter terms (e.g. {'action': 'block',
'clientCountryName': 'PL'}). Operators like `_in`, `_neq` may be
appended to the key (e.g. 'action_in': ['block', 'managed_challenge']).
limit: rows per page, clamped to [1, 500]. Default 50.
cursor: opaque continuation token from a prior call's `next_cursor`.
Returns: envelope with `data = {rows, count, page}` and `next_cursor`.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| zone_id | Yes | ||
| since | Yes | ||
| until | Yes | ||
| group_by | Yes | ||
| filters | No | ||
| limit | No | ||
| cursor | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |