
12/12/2019 · Nick Downie
What this post added
This post introduces the new GraphQL Analytics API and demonstrates its use in building Firewall Analytics. It details how the API enables querying firewall event aggregates (`firewallEventsAdaptiveGroups`) and individual events (`firewallEventsAdaptive`) using a schema-driven approach. Specific examples are provided for visualizing time-series data of firewall events by hour and action, identifying top N attributes (client IP, user agent) contributing to events, and retrieving raw event details for false positive analysis. The post also explains GraphQL query structure, schema exploration, and the use of filters and dimensions for data aggregation.