How to sort or download Firewall events list?

Dear all,

I was under attack today. I need to check the Firewall events, but there are more then one million entries during the last 6 hours. I want to see the first events (when everything started).

How can I sort the events descending OR download the last 6 hours into one file and analyze the list with an external viewer?

Thanks for your help.

The export button should allow for that.

Call me blind, but I cannot find such an button. :frowning:

Should be right on top

Is it not?

No, it’s not there:

It might not be available on your plan level then I am afraid.

Possibly https://api.cloudflare.com/#firewall-events-list-events might work. Otherwise, would the filter work?

Thanks for your quick help, that might be the reason. I only have the Professional Plan.

Support might be able to clarify this.

The API call might work too (though it does not specify which plan level), otherwise you could only try to filter it via the UI.

1 Like

Thanks again. I contacted the support to make sure, because I cannot find any information regarding the export function with different plans (https://www.cloudflare.com/plans/#compare-features).

The plan was just an assumption, as it shows up on a Business plan, but not on a Free plan and - as in your case - neither on a Professional one.

Answer from the support:

“You can pull the firewall events using the API. - https://api.cloudflare.com/#firewall-events-properties. Once you pull them down locally you can modify and sort however you would like.”

So thanks again. You’re 100% right. :slight_smile: