search_flows
Analyze network flows with advanced filters for historical data, specific time ranges, and complex queries. Supports pagination, geographic filtering, and all flow fields for in-depth network traffic insights.
Instructions
Search network flows with advanced query filters. Use this for: historical analysis, specific time ranges, complex filtering, or when you need more than 50 flows. Supports pagination, time-based queries (e.g., "ts:>1h" for last hour), and all flow fields including geographic filtering. For quick "what's happening now" snapshots, use get_recent_flow_activity instead.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | No | Pagination cursor from previous response | |
| groupBy | No | Group flows by specified values (e.g., "domain,box") | |
| limit | No | Maximum results (optional, default: 200, API maximum: 500) | |
| query | No | Search query using Firewalla syntax. Supported fields: protocol:tcp/udp, direction:inbound/outbound/local, blocked:true/false, bytes:>1MB, domain:*.example.com, region:US (country code), category:social/games/porn/etc, gid:box_id, device.ip:192.168.*, source_ip:*, destination_ip:*. Examples: "region:US AND protocol:tcp", "blocked:true AND bytes:>1MB", "category:social OR category:games" | |
| sortBy | No | Sort flows (default: "ts:desc") |