Returns firewall log events from the tenant's network security devices.
Events are sourced from the tenant's Elasticsearch index and include
source/destination IPs, geographic data, action taken, and a UBA risk score.

Use action to filter to blocked/dropped traffic only. Use since/until
to scope to a time window. Geographic aggregations (top source/destination
countries) are available as a separate query using aggregate=geo.