Skip to content

Retrieve network traffic flow logs with advanced filtering and pagination
deprecated

Request

This is deprecated; use /v2/audit/flow-logs instead.

Requires audits::read:flows permission.

Security
JWTAuthorizer
Query
sTimenumber

Unix timestamp lower bound for the flow start time

eTimenumber

Unix timestamp upper bound for the flow start time. This does not filter by flow end time.

eTimeOpstring

Comparison operator for the eTime flow start time bound. There is no end-time query filter.

Enum:"eq""ne""gt""gte""lt""lte"
protocolstring

IP protocol

srcIpstring

Source IP address

dstIpstring

Destination IP address

srcPortnumber

Source port

srcPortOpstring

Comparison operator for the source port

Enum:"eq""ne""gt""gte""lt""lte"
dstPortnumber

Destination port

dstPortOpstring

Comparison operator for the dest port

Enum:"eq""ne""gt""gte""lt""lte"
limitnumber

Maximum number of results to return

srcNodestring

Source node name

dstNodestring

Dest node name

nodestring

Flow logging node ID

reverseboolean

When true, newer flow logs will be listed first

tcpFlagsArray of numbers

If provided, a flow must match at least one of the TCP flags provided. Decimal encoded, see flow log TCP flag encoding.

cursorstring

Continuation cursor from previous query

curl -i -X GET \
  'https://apidocs.trustgrid.io/_mock/audit/tail/flow_logs?sTime=0&eTime=0&eTimeOp=eq&protocol=string&srcIp=string&dstIp=string&srcPort=0&srcPortOp=eq&dstPort=0&dstPortOp=eq&limit=0&srcNode=string&dstNode=string&node=string&reverse=true&tcpFlags=0&cursor=string' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>'

Responses

OK

Headers
x-cursorstring

Continuation cursor for the next query

Bodyapplication/json
Array [
nodeIdstring

ID of the node that logged this flow

sourceNodestring

Source node name

Example:"mynode"
sourceIPstring

Source IP address

Example:"2.2.2.2"
sourcePortnumber

Source port

Example:1234
sourceBytesnumber

Source bytes transferred

Example:100
destNodestring

Destination node name

Example:"mynode"
destIPstring

Destination IP address

Example:"1.1.1.1"
destPortnumber

Destination port

Example:1234
destBytesnumber

Destination bytes transferred

Example:100
startTimestring

Start time of the flow (ISO 8601)

Example:"2022-11-01T22:46:01.765Z"
endTimestring

End time of the flow (ISO 8601)

Example:"2022-11-01T22:46:02.730Z"
protocolstring

Protocol

Enum:"TCP""UDP""ICMP""UNKNOWN"
Example:"TCP"
tcpFlagsstring

TCP flags as a bitmask encoded decimal string:

  • 0x01 - FIN
  • 0x02 - SYN
  • 0x04 - RST
  • 0x08 - PSH
  • 0x10 - ACK
  • 0x20 - URG
Example:"2"
flagsstring

Additional flow flags as a decimal string

Example:"40019"
activityIDstring

Threat Intelligence activity ID (if applicable)

Example:"9aa2bbc3-4265-475b-b977-c94b1ee25a1f"
metaobject or null

Additional metadata about the flow event. Contents vary by event source and may include arbitrary string, numeric, or nested values. Nullable.

]
Response
[
  {
    "nodeId": "string",
    "sourceNode": "mynode",
    "sourceIP": "2.2.2.2",
    "sourcePort": 1234,
    "sourceBytes": 100,
    "destNode": "mynode",
    "destIP": "1.1.1.1",
    "destPort": 1234,
    "destBytes": 100,
    "startTime": "2022-11-01T22:46:01.765Z",
    "endTime": "2022-11-01T22:46:02.730Z",
    "protocol": "TCP",
    "tcpFlags": "2",
    "flags": "40019",
    "activityID": "9aa2bbc3-4265-475b-b977-c94b1ee25a1f",
    "meta": {}
  }
]