List firewall events

get

https://api.adlumin.com/v1/firewall

Returns firewall log events from the tenant's network security devices.
Events are sourced from the tenant's Elasticsearch index and include
source/destination IPs, geographic data, action taken, and a UBA risk score.

Use action to filter to blocked/dropped traffic only. Use since/until
to scope to a time window. Geographic aggregations (top source/destination
countries) are available as a separate query using aggregate=geo.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

tenant_id

string

required

Identifier of the tenant to scope this request to. Required on every request that supports tenant scoping. Example format: tnt_4f81ac.

page

integer

≥ 1

Defaults to 1

Page number (1-indexed)

per_page

integer

1 to 100

Defaults to 25

Number of records per page (max 100)

since

date-time

Return records on or after this timestamp (ISO 8601)

until

date-time

Return records on or before this timestamp (ISO 8601)

string

Free-text search term applied across key fields

sort_column

string

Field name to sort by

sort_dir

string

enum

Defaults to desc

Sort direction

Allowed:

action

string

enum

Filter by firewall action

Allowed:

source_country

string

Filter by source country code (ISO 3166-1 alpha-2)

destination_country

string

Filter by destination country code (ISO 3166-1 alpha-2)

aggregate

string

enum

Return aggregations instead of raw events.

geo: top source/destination countries
blocked_ips: top 15 blocked source IPs by month

Allowed:

Responses

Language

Credentials

Header

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200Firewall events or aggregation results

401Missing or invalid API key