search_flows
Search and analyze network flows with advanced filters for historical data, time ranges, or geographic details. Supports pagination, custom queries, and grouping for detailed insights.
Instructions
Search network flows with advanced query filters. Use this for: historical analysis, specific time ranges, complex filtering, or when you need more than 50 flows. Supports pagination, time-based queries (e.g., "ts:>1h" for last hour), and all flow fields including geographic filtering. For quick "what's happening now" snapshots, use get_recent_flow_activity instead.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | No | Pagination cursor from previous response | |
| groupBy | No | Group flows by specified values (e.g., "domain,box") | |
| limit | No | Maximum results (optional, default: 200, API maximum: 500) | |
| query | No | Search query using Firewalla syntax. Supported fields: protocol:tcp/udp, direction:inbound/outbound/local, blocked:true/false, bytes:>1MB, domain:*.example.com, region:US (country code), category:social/games/porn/etc, gid:box_id, device.ip:192.168.*, source_ip:*, destination_ip:*. Examples: "region:US AND protocol:tcp", "blocked:true AND bytes:>1MB", "category:social OR category:games" | |
| sortBy | No | Sort flows (default: "ts:desc") |