search_flows
Search network flows using advanced queries for historical analysis, specific time ranges, and complex filtering, supporting pagination and geographic filters.
Instructions
Search network flows with advanced query filters. Use this for: historical analysis, specific time ranges, complex filtering, or when you need more than 50 flows. Supports pagination, time-based queries (e.g., "ts:>1h" for last hour), and all flow fields including geographic filtering. For quick "what's happening now" snapshots, use get_recent_flow_activity instead.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results (optional, default: 200, API maximum: 500) | |
| query | Yes | Search query using Firewalla syntax. Supported fields: protocol:tcp/udp, direction:inbound/outbound/local, blocked:true/false, bytes:>1MB, domain:*.example.com, region:US (country code), category:social/games/porn/etc, gid:box_id, device.ip:192.168.*, source_ip:*, destination_ip:*. Examples: "region:US AND protocol:tcp", "blocked:true AND bytes:>1MB", "category:social OR category:games" | |
| cursor | No | Pagination cursor from previous response | |
| sortBy | No | Sort flows (default: "ts:desc") | |
| groupBy | No | Group flows by specified values (e.g., "domain,box") |