Skip to content

Audit

Immutable logs for compliance and troubleshooting. Trustgrid exposes authentication audits (audits::read:user), configuration changes (audits::read:config), node events (audits::read:node), and flow logs (audits::read:flows).

Operations

Retrieve network traffic flow logs with advanced filtering and pagination

Request

Requires audits::read:flows permission.

Security
JWTAuthorizer
Query
sTimenumber

Unix timestamp lower bound for the flow start time

eTimenumber

Unix timestamp upper bound for the flow start time. This does not filter by flow end time.

eTimeOpstring

Comparison operator for the eTime flow start time bound. There is no end-time query filter.

Enum:"eq""ne""gt""gte""lt""lte"
protocolstring

IP protocol

srcIpstring

Source IP address

dstIpstring

Destination IP address

srcPortnumber

Source port

srcPortOpstring

Comparison operator for the source port

Enum:"eq""ne""gt""gte""lt""lte"
dstPortnumber

Destination port

dstPortOpstring

Comparison operator for the dest port

Enum:"eq""ne""gt""gte""lt""lte"
limitnumber

Maximum number of results to return

srcNodestring

Source node name

dstNodestring

Dest node name

nodestring

Flow logging node ID

pagestring

Page of results to return

sortstring

Sort results, like port:desc

reverseboolean

When true, newer flow logs will be listed first

tcpFlagsArray of numbers

If provided, a flow must match at least one of the TCP flags provided. Decimal encoded, see flow log TCP flag encoding.

flagsArray of numbers

If provided, a flow must match at least one of the flow flags provided. Decimal encoded. Known flag values: 65536 (no ACL match), 131072 (no rule match), 262144 (no route), 524288 (invalid TCP), 67108864 (TLS cert expired), 134217728 (TLS name mismatch), 268435456 (TLS self-signed), 536870912 (TLS mutual auth required).

defunctboolean

When true, returns only flows blocked or rejected by security controls — equivalent to filtering by the union of all defunct flow flags (no ACL, no rule, no route, invalid TCP, and all TLS error flags). Cannot be combined with flags.

curl -i -X GET \
  'https://apidocs.trustgrid.io/_mock/v2/audit/flow-logs?sTime=0&eTime=0&eTimeOp=eq&protocol=string&srcIp=string&dstIp=string&srcPort=0&srcPortOp=eq&dstPort=0&dstPortOp=eq&limit=0&srcNode=string&dstNode=string&node=string&page=string&sort=string&reverse=true&tcpFlags=0&flags=0&defunct=true' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>'

Responses

OK

Headers
x-total-countnumber

Total number of flows matching query

Bodyapplication/json
Array [
nodeIdstring

ID of the node that logged this flow

sourceNodestring

Source node name

Example:"mynode"
sourceIPstring

Source IP address

Example:"2.2.2.2"
sourcePortnumber

Source port

Example:1234
sourceBytesnumber

Source bytes transferred

Example:100
destNodestring

Destination node name

Example:"mynode"
destIPstring

Destination IP address

Example:"1.1.1.1"
destPortnumber

Destination port

Example:1234
destBytesnumber

Destination bytes transferred

Example:100
startTimestring

Start time of the flow (ISO 8601)

Example:"2022-11-01T22:46:01.765Z"
endTimestring

End time of the flow (ISO 8601)

Example:"2022-11-01T22:46:02.730Z"
protocolstring

Protocol

Enum:"TCP""UDP""ICMP""UNKNOWN"
Example:"TCP"
tcpFlagsstring

TCP flags as a bitmask encoded decimal string:

  • 0x01 - FIN
  • 0x02 - SYN
  • 0x04 - RST
  • 0x08 - PSH
  • 0x10 - ACK
  • 0x20 - URG
Example:"2"
flagsstring

Additional flow flags as a decimal string

Example:"40019"
activityIDstring

Threat Intelligence activity ID (if applicable)

Example:"9aa2bbc3-4265-475b-b977-c94b1ee25a1f"
metaobject or null

Additional metadata about the flow event. Contents vary by event source and may include arbitrary string, numeric, or nested values. Nullable.

]
Response
[
  {
    "nodeId": "string",
    "sourceNode": "mynode",
    "sourceIP": "2.2.2.2",
    "sourcePort": 1234,
    "sourceBytes": 100,
    "destNode": "mynode",
    "destIP": "1.1.1.1",
    "destPort": 1234,
    "destBytes": 100,
    "startTime": "2022-11-01T22:46:01.765Z",
    "endTime": "2022-11-01T22:46:02.730Z",
    "protocol": "TCP",
    "tcpFlags": "2",
    "flags": "40019",
    "activityID": "9aa2bbc3-4265-475b-b977-c94b1ee25a1f",
    "meta": {}
  }
]