zins_get_firewall_by_action
Retrieve Zero Trust Firewall traffic aggregated by allow and block actions for read-only analytics over a 7- or 14-day window.
Instructions
Get Zero Trust Firewall traffic grouped by action (allow/block). Read-only analytics.
One row per action with its aggregated total — the allowed-vs-blocked split. Window must be a 7- or 14-day historical interval.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get the full records. | |
| end_time | No | ||
| start_time | No | ||
| end_days_ago | No | ||
| start_days_ago | No |