← Analytics / analytics / graphql-api / tutorials
Dotazování na události firewallu pomocí GraphQL
V tomto příkladu použijeme GraphQL Analytics API k dotazování Firewall Events za zadané časové období.
Následující volání API požádá o události Firewall za období jedné hodiny a vypíše požadovaná pole. Nezapomeňte nahradit <CLOUDFLARE_ZONE_TAG>, <EMAIL>, a <API_TOKEN>1 svým zone tagem a API přihlašovacími údaji a upravte datetime_geg a datetime_leq hodnoty podle svých potřeb.
Volání API
echo '{ "query":
"query ListFirewallEvents($zoneTag: string, $filter: FirewallEventsAdaptiveFilter_InputObject) {
viewer {
zones(filter: { zoneTag: $zoneTag }) {
firewallEventsAdaptive(
filter: $filter
limit: 10
orderBy: [datetime_DESC]
) {
action
clientAsn
clientCountryName
clientIP
clientRequestPath
clientRequestQuery
datetime
source
userAgent
}
}
}
}",
"variables": {
"zoneTag": "<CLOUDFLARE_ZONE_TAG>",
"filter": {
"datetime_geq": "2022-07-24T11:00:00Z",
"datetime_leq": "2022-07-24T12:00:00Z"
}
}
}' | tr -d '\n' | curl --silent \
https://api.cloudflare.com/client/v4/graphql \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Accept: application/json" \
--header "Content-Type: application/json" \
--data @-Vrácené výsledky budou ve formátu JSON (dle požadavku), proto výstup můžete přesměrovat rourou do jq je usnadní čtení, například:
... | curl --silent \
https://api.cloudflare.com/client/v4/graphql \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Accept: application/json" \
--header "Content-Type: application/json" \
--data @- | jq .
#=> {
#=> "data": {
#=> "viewer": {
#=> "zones": [
#=> {
#=> "firewallEventsAdaptive": [
#=> {
#=> "action": "log",
#=> "clientAsn": "5089",
#=> "clientCountryName": "GB",
#=> "clientIP": "203.0.113.69",
#=> "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:11:24Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"
#=> },
#=> {
#=> "action": "log",
#=> "clientAsn": "5089",
#=> "clientCountryName": "GB",
#=> "clientIP": "203.0.113.69",
#=> "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:11:24Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"
#=> },
#=> {
#=> "action": "log",
#=> "clientAsn": "5089",
#=> "clientCountryName": "GB",
#=> "clientIP": "203.0.113.69",
#=> "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:11:24Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"
#=> },
#=> {
#=> "action": "log",
#=> "clientAsn": "5089",
#=> "clientCountryName": "GB",
#=> "clientIP": "203.0.113.69",
#=> "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:11:24Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"
#=> },
#=> {
#=> "action": "log",
#=> "clientAsn": "5089",
#=> "clientCountryName": "GB",
#=> "clientIP": "203.0.113.69",
#=> "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:11:24Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"
#=> },
#=> {
#=> "action": "log",
#=> "clientAsn": "5089",
#=> "clientCountryName": "GB",
#=> "clientIP": "203.0.113.69",
#=> "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:11:24Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"
#=> },
#=> {
#=> "action": "log",
#=> "clientAsn": "5089",
#=> "clientCountryName": "GB",
#=> "clientIP": "203.0.113.69",
#=> "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:11:24Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"
#=> },
#=> {
#=> "action": "block",
#=> "clientAsn": "5089",
#=> "clientCountryName": "GB",
#=> "clientIP": "203.0.113.69",
#=> "clientRequestPath": "/%3Cscript%3Ealert()%3C/script%3E",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:11:24Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36"
#=> },
#=> {
#=> "action": "log",
#=> "clientAsn": "58224",
#=> "clientCountryName": "IR",
#=> "clientIP": "2.183.175.37",
#=> "clientRequestPath": "/api/v2",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:00:54Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
#=> },
#=> {
#=> "action": "log",
#=> "clientAsn": "58224",
#=> "clientCountryName": "IR",
#=> "clientIP": "2.183.175.37",
#=> "clientRequestPath": "/api/v2",
#=> "clientRequestQuery": "",
#=> "datetime": "2020-04-24T10:00:54Z",
#=> "source": "waf",
#=> "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
#=> }
#=> ]
#=> }
#=> ]
#=> }
#=> },
#=> "errors": null
#=> }Doba uchovávání dat a okno dotazu
firewallEventsAdaptive dataset, který pohání Security Events, má jiné limity uchovávání dat než datové sady používané v Security Analytics. Dotazy, které překročí okno uchovávání dat, vrátí chybu podobnou této:
cannot request data older than 2678400sInformace o limitech podle tarifu pro firewallEventsAdaptive sadu dat viz Security Events.
Chcete-li programově zjistit přesné limity pro vaši zónu, proveďte dotaz na settings uzel:
{
viewer {
zones(filter: { zoneTag: "<CLOUDFLARE_ZONE_TAG>" }) {
settings {
firewallEventsAdaptive {
maxDuration
maxPageSize
notOlderThan
}
httpRequestsAdaptive {
maxDuration
maxPageSize
notOlderThan
}
}
}
}
}Více informací o settings uzel, viz Uzel nastavení.
Poznámky pod čarou
-
Viz Nakonfigurujte token Analytics API kde najdete další informace o konfiguraci a oprávněních. ↩