cloudflare-firewall-events

List Firewall events from Cloudflare service.

Syntax

cloudflare-firewall-events [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [order=ORDER] [extra=EXTRA]

Options

profile=PROFILE: Optional. Connect profile code of Cloudflare
duration=NUM{mon|w|d|h|m|s}: Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Optional. Start time of range. yyyyMMddHHmmss format. (default 31 days ago)
to=yyyyMMddHHmmss: Optional. End time of range. yyyyMMddHHmmss format. (default current time)
order=ORDER: Optional. asc or desc. (default desc)
extra=EXTRA: Optional. Include Enterprise-only fields (WAF attack score etc.): t/true or f/false. (default f)

Output Fields

Field	Type	Name	Description
_time	Date	Time	The date and time the event occurred at the edge.
profile	String	Connect Profile	Cloudflare connect profile code
source	String	Source	Event source
src_ip	IP address	Source IP	The visitor's IP address (IPv4 or IPv6).
src_country	String	Source Country	Country from which request originated.
src_asn	String	Source ASN	Autonomous System Number of the source network.
ray_id	String	Ray ID	Cloudflare Ray ID
signature	String	Signature	The description of the rule triggered by this request.
action	String	Action	The code of the first-class action the Cloudflare Firewall took on this request.
attack_score	Integer	Attack Score	Overall attack score
attack_score_class	String	Attack Score Class	Classification of attack score
status	Integer	Status	Edge response status code
origin_status	Integer	Origin Status	HTTP origin response status code returned to browser.
method	String	Method	The HTTP method used by the visitor.
scheme	String	Scheme	The URL scheme requested by the visitor.
host	String	Host	The HTTP hostname requested by the visitor.
path	String	Path	The path requested by visitor.
query	String	Query	The query-string was requested by the visitor.
http_ver	String	HTTP Version	The version of HTTP protocol requested by the visitor.
user_agent	String	User Agent	Visitor's user-agent string.
sqli_score	Integer	SQLi Score	SQL injection attack score
xss_score	Integer	XSS Score	Cross-site scripting attack score
rce_score	Integer	RCE Score	Remote code execution attack score
ml_attack_score	Integer	ML Attack Score	Machine learning based attack score
ml_sqli_score	Integer	ML SQLi Score	Machine learning based SQL injection score
ml_xss_score	Integer	ML XSS Score	Machine learning based XSS attack score
is_scan_failed	Integer	Scan Failed	Content scan failure status
leaked_credential	String	Leaked Credential	Leaked credential check result
rule_id	String	Rule ID	Triggered rule identifier
ruleset_id	String	Rule Set ID	Rule set identifier
ref	String	Reference	Event reference
referer_scheme	String	Referer Scheme	The referer URL scheme requested by the visitor.
referer_host	String	Referer Host	The referer host.
referer_path	String	Referer Path	The referer path requested by visitor.
referer_query	String	Referer Query	The referer query-string was requested by the visitor.
zone_ver	Integer	Zone Version	Zone version number
edge_colo_id	String	Edge Colo ID	PoP identifier
edge_colo_name	String	Edge Colo Name	PoP name.