Cloudflare Developers•13mo ago

Listing Firewall Events..

I am listing Cloudflare firewall events. However, instead of writing which rule is in the source section, it says firewallCustom. How can i fix this... My code: https://discord.com/channels/595317990191398933/1114130327351332964 Source eq: Http 1.0 Block Rule...

{
    "events": [
        {
            "action": "skip",
            "clientAsn": "8075",
            "clientCountryName": "US",
            "clientIP": "52.167.144.131",
            "clientRequestPath": "/robots.txt",
            "clientRequestQuery": "",
            "datetime": "2023-06-02T19:40:40Z",
            "source": "firewallCustom",
            "userAgent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/103.0.5060.134 Safari/537.36"
        }
    ]
}

{
    "events": [
        {
            "action": "skip",
            "clientAsn": "8075",
            "clientCountryName": "US",
            "clientIP": "52.167.144.131",
            "clientRequestPath": "/robots.txt",
            "clientRequestQuery": "",
            "datetime": "2023-06-02T19:40:40Z",
            "source": "firewallCustom",
            "userAgent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/103.0.5060.134 Safari/537.36"
        }
    ]
}

20 Replies

Chaika•13mo ago

source is just the product. You want ruleId or rulesetId I believe

lokiwind•13mo ago

Yeah, it could be ruleid, it doesn't matter.

Chaika•13mo ago

what do you mean? Are you saying those fields don't contain the http 1.0 block rule id?

lokiwind•13mo ago

I want to know which rule the incident belongs to Listing all events for Cloudflare custom rule I would like to know which custom rule these listed events belong to

Chaika•13mo ago

That's the ruleSetId property

lokiwind•13mo ago

Hmm so I can't use this feature in firewall events

Chaika•13mo ago

Chaika•13mo ago

that rule has a ID for itself (rulesetId), and an ID for each of the specific rules within it (ruleId)

Chaika•13mo ago

and in events, the ruleId = that

Chaika•13mo ago

you can filter by it as well

lokiwind•13mo ago

Ah ok does every custom rule have a ruleset id

Chaika•13mo ago

err sorry I explained that a bit weirdly, every rule has a ruleId, the rulesetId is the ID for all custom rules in general

Chaika•13mo ago

(you can filter by either, of course)

lokiwind•13mo ago

hmm It's too complicated. 😦

Chaika•13mo ago

If you want to filter for a specific rule, just get the rule id, and filter by ruleId . The ruleSetId is just the same ID for all custom rules within your zone, as I understand it

lokiwind•13mo ago

https://developers.cloudflare.com/analytics/graphql-api/tutorials/querying-magic-firewall-samples/ Isn't it like the use here

Querying Magic Firewall Samples with GraphQL · Cloudflare Analytics...

In this example, we are going to use the GraphQL Analytics API to query for Magic Firewall Samples over a specified time period.

Chaika•13mo ago

looks like it, yep.

lokiwind•13mo ago

😘

Chaika•13mo ago

If it's worth mentioning, that uses groups with sampling, i.e firewallEventsAdaptiveGroups, not firewallEventsAdaptive, and firewallEventsAdaptiveGroups seems to be Pro or higher even without that exact query though, you can just add ruleId to your list of fields in firewallEventsAdaptive and do the grouping/counting yourself, up to a point

lokiwind•13mo ago

{
    "events": [
        {
            "action": "challenge",
            "clientAsn": "4134",
            "clientCountryName": "CN",
            "clientIP": "124.235.138.30",
            "clientRequestPath": "/",
            "clientRequestQuery": "",
            "datetime": "2023-06-02T21:36:26Z",
            "source": "firewallCustom",
            "userAgent": "Mozilla/5.0 (iPad; CPU OS 9_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13B143 Safari/601.1",
            "ruleId": "f51e15c853554faaa9c0f9165785b0f8"
        }
    ]
}

{
    "events": [
        {
            "action": "challenge",
            "clientAsn": "4134",
            "clientCountryName": "CN",
            "clientIP": "124.235.138.30",
            "clientRequestPath": "/",
            "clientRequestQuery": "",
            "datetime": "2023-06-02T21:36:26Z",
            "source": "firewallCustom",
            "userAgent": "Mozilla/5.0 (iPad; CPU OS 9_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13B143 Safari/601.1",
            "ruleId": "f51e15c853554faaa9c0f9165785b0f8"
        }
    ]
}

Yeah, I got it, thank you, mate. @chaika.me

Gaming

Programming

Listing Firewall Events..