cf_query_firewall_events_raw
Retrieve raw firewall events for a zone over a specified time window, with filters and pagination to investigate security incidents.
Instructions
Raw firewall events (one row per individual event) over a time window.
Calls: POST /graphql, firewallEventsAdaptive dataset.
Args:
zone_id: zone tag.
since, until: ISO-8601 time range.
filters: extra filter terms.
limit: rows per page, clamped to [1, 500]. Default 50.
cursor: continuation token.
verbose: when True, includes additional fields like userAgent,
referer, rayName, clientRequestPath. Subject to the same
~20K-token response ceiling — narrow `limit` accordingly.
Returns: envelope with `data = {rows, count, page}` and `next_cursor`.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| zone_id | Yes | ||
| since | Yes | ||
| until | Yes | ||
| filters | No | ||
| limit | No | ||
| cursor | No | ||
| verbose | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |