{
  "sql": "SELECT\n  RayID AS ray_id,\n  EdgeResponseStatus AS status,\n  '[REDACTED]' AS client_ip_redacted,\n  'cloudflare' AS provider\nFROM http_requests\nWHERE EdgeResponseStatus >= 400\n",
  "input": {
    "RayID": "0000000000000001",
    "ClientIP": "203.0.113.24",
    "EdgeResponseStatus": 403,
    "ClientRequestURI": "/login?email=sample%40example.invalid",
    "ClientRequestUserAgent": "SyntheticProbe/1.0"
  }
}