Get email security time series grouped by dimension

client.Radar.Email.Security.TimeseriesGroupsV2(ctx, dimension, query) (*EmailSecurityTimeseriesGroupsV2Response, error)

GET/radar/email/security/timeseries_groups/{dimension}

Retrieves the distribution of email security metrics grouped by dimension over time.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

User Details WriteUser Details Read

ParametersExpand Collapse

dimension EmailSecurityTimeseriesGroupsV2ParamsDimension

Specifies the attribute by which to group the results.

One of the following:

const EmailSecurityTimeseriesGroupsV2ParamsDimensionSpam EmailSecurityTimeseriesGroupsV2ParamsDimension = "SPAM"

const EmailSecurityTimeseriesGroupsV2ParamsDimensionMalicious EmailSecurityTimeseriesGroupsV2ParamsDimension = "MALICIOUS"

const EmailSecurityTimeseriesGroupsV2ParamsDimensionSpoof EmailSecurityTimeseriesGroupsV2ParamsDimension = "SPOOF"

const EmailSecurityTimeseriesGroupsV2ParamsDimensionThreatCategory EmailSecurityTimeseriesGroupsV2ParamsDimension = "THREAT_CATEGORY"

const EmailSecurityTimeseriesGroupsV2ParamsDimensionARC EmailSecurityTimeseriesGroupsV2ParamsDimension = "ARC"

const EmailSecurityTimeseriesGroupsV2ParamsDimensionDKIM EmailSecurityTimeseriesGroupsV2ParamsDimension = "DKIM"

const EmailSecurityTimeseriesGroupsV2ParamsDimensionDMARC EmailSecurityTimeseriesGroupsV2ParamsDimension = "DMARC"

const EmailSecurityTimeseriesGroupsV2ParamsDimensionSPF EmailSecurityTimeseriesGroupsV2ParamsDimension = "SPF"

const EmailSecurityTimeseriesGroupsV2ParamsDimensionTLSVersion EmailSecurityTimeseriesGroupsV2ParamsDimension = "TLS_VERSION"

query EmailSecurityTimeseriesGroupsV2Params

AggInterval param.Field[EmailSecurityTimeseriesGroupsV2ParamsAggInterval]Optional

Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals. When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

const EmailSecurityTimeseriesGroupsV2ParamsAggInterval15m EmailSecurityTimeseriesGroupsV2ParamsAggInterval = "15m"

const EmailSecurityTimeseriesGroupsV2ParamsAggInterval1h EmailSecurityTimeseriesGroupsV2ParamsAggInterval = "1h"

const EmailSecurityTimeseriesGroupsV2ParamsAggInterval1d EmailSecurityTimeseriesGroupsV2ParamsAggInterval = "1d"

const EmailSecurityTimeseriesGroupsV2ParamsAggInterval1w EmailSecurityTimeseriesGroupsV2ParamsAggInterval = "1w"

ARC param.Field[[]EmailSecurityTimeseriesGroupsV2ParamsARC]Optional

Filters results by ARC (Authenticated Received Chain) validation.

const EmailSecurityTimeseriesGroupsV2ParamsARCPass EmailSecurityTimeseriesGroupsV2ParamsARC = "PASS"

const EmailSecurityTimeseriesGroupsV2ParamsARCNone EmailSecurityTimeseriesGroupsV2ParamsARC = "NONE"

const EmailSecurityTimeseriesGroupsV2ParamsARCFail EmailSecurityTimeseriesGroupsV2ParamsARC = "FAIL"

DateEnd param.Field[[]Time]Optional

End of the date range (inclusive). Alternative to dateRange; provide together with dateStart. When requesting comparison series, every series must resolve to the same duration as the main series. Each dateStart/dateEnd is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

DateRange param.Field[[]string]Optional

Filters results by relative date range ending at the current time, with each value producing a separate series. Use <n>d for days (up to 364d) or <n>w for weeks (up to 52w). Append control to request the equivalent previous period for comparison: the comparison window is shifted back by the current window’s length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. 7dcontrol covers days -14 to -7, 10dcontrol covers days -24 to -14). For example, pass 7d and 7dcontrol to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including control) satisfy this automatically. Use this parameter or set specific start and end dates (dateStart and dateEnd parameters).

DateStart param.Field[[]Time]Optional

Start of the date range. Alternative to dateRange; provide together with dateEnd. When requesting comparison series, every series must resolve to the same duration as the main series. Each dateStart/dateEnd is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

DKIM param.Field[[]EmailSecurityTimeseriesGroupsV2ParamsDKIM]Optional

Filters results by DKIM (DomainKeys Identified Mail) validation status.

const EmailSecurityTimeseriesGroupsV2ParamsDKIMPass EmailSecurityTimeseriesGroupsV2ParamsDKIM = "PASS"

const EmailSecurityTimeseriesGroupsV2ParamsDKIMNone EmailSecurityTimeseriesGroupsV2ParamsDKIM = "NONE"

const EmailSecurityTimeseriesGroupsV2ParamsDKIMFail EmailSecurityTimeseriesGroupsV2ParamsDKIM = "FAIL"

DMARC param.Field[[]EmailSecurityTimeseriesGroupsV2ParamsDMARC]Optional

Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status.

const EmailSecurityTimeseriesGroupsV2ParamsDMARCPass EmailSecurityTimeseriesGroupsV2ParamsDMARC = "PASS"

const EmailSecurityTimeseriesGroupsV2ParamsDMARCNone EmailSecurityTimeseriesGroupsV2ParamsDMARC = "NONE"

const EmailSecurityTimeseriesGroupsV2ParamsDMARCFail EmailSecurityTimeseriesGroupsV2ParamsDMARC = "FAIL"

Format param.Field[EmailSecurityTimeseriesGroupsV2ParamsFormat]Optional

Format in which results will be returned.

const EmailSecurityTimeseriesGroupsV2ParamsFormatJson EmailSecurityTimeseriesGroupsV2ParamsFormat = "JSON"

const EmailSecurityTimeseriesGroupsV2ParamsFormatCsv EmailSecurityTimeseriesGroupsV2ParamsFormat = "CSV"

LimitPerGroup param.Field[int64]Optional

Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an “other” category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2.

Name param.Field[[]string]Optional

Array of names used to label the series in the response.

SPF param.Field[[]EmailSecurityTimeseriesGroupsV2ParamsSPF]Optional

Filters results by SPF (Sender Policy Framework) validation status.

const EmailSecurityTimeseriesGroupsV2ParamsSPFPass EmailSecurityTimeseriesGroupsV2ParamsSPF = "PASS"

const EmailSecurityTimeseriesGroupsV2ParamsSPFNone EmailSecurityTimeseriesGroupsV2ParamsSPF = "NONE"

const EmailSecurityTimeseriesGroupsV2ParamsSPFFail EmailSecurityTimeseriesGroupsV2ParamsSPF = "FAIL"

TLSVersion param.Field[[]EmailSecurityTimeseriesGroupsV2ParamsTLSVersion]Optional

Filters results by TLS version.

const EmailSecurityTimeseriesGroupsV2ParamsTLSVersionTlSv1_0 EmailSecurityTimeseriesGroupsV2ParamsTLSVersion = "TLSv1_0"

const EmailSecurityTimeseriesGroupsV2ParamsTLSVersionTlSv1_1 EmailSecurityTimeseriesGroupsV2ParamsTLSVersion = "TLSv1_1"

const EmailSecurityTimeseriesGroupsV2ParamsTLSVersionTlSv1_2 EmailSecurityTimeseriesGroupsV2ParamsTLSVersion = "TLSv1_2"

const EmailSecurityTimeseriesGroupsV2ParamsTLSVersionTlSv1_3 EmailSecurityTimeseriesGroupsV2ParamsTLSVersion = "TLSv1_3"

ReturnsExpand Collapse

type EmailSecurityTimeseriesGroupsV2Response struct{…}

Meta EmailSecurityTimeseriesGroupsV2ResponseMeta

Metadata for the results.

AggInterval EmailSecurityTimeseriesGroupsV2ResponseMetaAggInterval

Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals.

One of the following:

const EmailSecurityTimeseriesGroupsV2ResponseMetaAggIntervalFifteenMinutes EmailSecurityTimeseriesGroupsV2ResponseMetaAggInterval = "FIFTEEN_MINUTES"

const EmailSecurityTimeseriesGroupsV2ResponseMetaAggIntervalOneHour EmailSecurityTimeseriesGroupsV2ResponseMetaAggInterval = "ONE_HOUR"

const EmailSecurityTimeseriesGroupsV2ResponseMetaAggIntervalOneDay EmailSecurityTimeseriesGroupsV2ResponseMetaAggInterval = "ONE_DAY"

const EmailSecurityTimeseriesGroupsV2ResponseMetaAggIntervalOneWeek EmailSecurityTimeseriesGroupsV2ResponseMetaAggInterval = "ONE_WEEK"

const EmailSecurityTimeseriesGroupsV2ResponseMetaAggIntervalOneMonth EmailSecurityTimeseriesGroupsV2ResponseMetaAggInterval = "ONE_MONTH"

ConfidenceInfo EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfo

Annotations []EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotation

DataSource EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource

Data source for annotations.

One of the following:

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceAll EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "ALL"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceAIBots EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "AI_BOTS"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceAIGateway EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "AI_GATEWAY"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceBGP EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "BGP"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceBots EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "BOTS"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceConnectionAnomaly EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "CONNECTION_ANOMALY"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceCT EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "CT"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceDNS EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "DNS"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceDNSMagnitude EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "DNS_MAGNITUDE"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceDNSAS112 EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "DNS_AS112"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceDos EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "DOS"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceEmailRouting EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "EMAIL_ROUTING"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceEmailSecurity EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "EMAIL_SECURITY"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceFw EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "FW"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceFwPg EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "FW_PG"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceHTTP EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceHTTPControl EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_CONTROL"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceHTTPCrawlerReferer EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_CRAWLER_REFERER"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceHTTPOrigins EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP_ORIGINS"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceIQI EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "IQI"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceLeakedCredentials EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "LEAKED_CREDENTIALS"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceNet EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "NET"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceRobotsTXT EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "ROBOTS_TXT"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceSpeed EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "SPEED"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceWorkersAI EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "WORKERS_AI"

Description string

EndDate Time

formatdate-time

EventType EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType

Event type for annotations.

One of the following:

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypeEvent EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "EVENT"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypeGeneral EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "GENERAL"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypeOutage EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "OUTAGE"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypePartialProjection EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "PARTIAL_PROJECTION"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypePipeline EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "PIPELINE"

const EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypeTrafficAnomaly EmailSecurityTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "TRAFFIC_ANOMALY"

IsInstantaneous bool

Whether event is a single point in time or a time range.

LinkedURL string

formaturi

StartDate Time

formatdate-time

Tags []stringOptional

Level int64

Provides an indication of how much confidence Cloudflare has in the data.

DateRange []EmailSecurityTimeseriesGroupsV2ResponseMetaDateRange

EndTime Time

Adjusted end of date range.

formatdate-time

StartTime Time

Adjusted start of date range.

formatdate-time

LastUpdated Time

Timestamp of the last dataset update.

formatdate-time

Normalization EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization

Normalization method applied to the results. Refer to Normalization methods.

One of the following:

const EmailSecurityTimeseriesGroupsV2ResponseMetaNormalizationPercentage EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization = "PERCENTAGE"

const EmailSecurityTimeseriesGroupsV2ResponseMetaNormalizationMin0Max EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization = "MIN0_MAX"

const EmailSecurityTimeseriesGroupsV2ResponseMetaNormalizationMinMax EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization = "MIN_MAX"

const EmailSecurityTimeseriesGroupsV2ResponseMetaNormalizationRawValues EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization = "RAW_VALUES"

const EmailSecurityTimeseriesGroupsV2ResponseMetaNormalizationPercentageChange EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization = "PERCENTAGE_CHANGE"

const EmailSecurityTimeseriesGroupsV2ResponseMetaNormalizationRollingAverage EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization = "ROLLING_AVERAGE"

const EmailSecurityTimeseriesGroupsV2ResponseMetaNormalizationOverlappedPercentage EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization = "OVERLAPPED_PERCENTAGE"

const EmailSecurityTimeseriesGroupsV2ResponseMetaNormalizationRatio EmailSecurityTimeseriesGroupsV2ResponseMetaNormalization = "RATIO"

Units []EmailSecurityTimeseriesGroupsV2ResponseMetaUnit

Measurement units for the results.

Name string

Value string

Serie0 EmailSecurityTimeseriesGroupsV2ResponseSerie0

Timestamps []Time

Get email security time series grouped by dimension

package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/option"
  "github.com/cloudflare/cloudflare-go/radar"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.Radar.Email.Security.TimeseriesGroupsV2(
    context.TODO(),
    radar.EmailSecurityTimeseriesGroupsV2ParamsDimensionSpam,
    radar.EmailSecurityTimeseriesGroupsV2Params{

    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.Meta)
}

{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}

Returns Examples

{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}