Firewall Events Endpoint


we have a couple of rate limit rules active, where I can see which IP is hitting them how often. It would be great if I can shift from checking these values daily per hand, to an automated way. As, for example an IP is hitting the rate limit 2 millions in 24 hours, I wanna block them forever.
In theory, writing some tool that checks which IP has hit the rate limit in the last 24 hours and based on this info, update the block rules, would be easy.
But, I wasn’t able to found any api endpoint to “what IP hit the rate limit”, is this just missing or wasn’t I not able to find?