FlowInfo

FlowInfo
Flow Info

Summary-level timing and status information about a deduplicated flow record.

Notes:

  • last_session_start_time and last_session_end_time reflect the most recently observed session within the query window.
  • For active flows, last_session_end_time is the time the flow was last reported, not a true end time.
  • is_active is true for currently open sessions and false for completed sessions.
  • flow_type is the effective (most recently observed) flow type (e.g., ALLOWED, BLOCKED, UN_MICROSEGMENTED).
  • flow_traffic_type indicates unicast, broadcast, or multicast traffic.
JSON Example 
{
    "last_session_start_time": 0,
    "last_session_end_time": 0,
    "flow_type": "string",
    "flow_traffic_type": "string",
    "is_active": false
}
integer As int64 As int64
last_session_start_time
Optional

Last session start time. The number of seconds since epoch.

integer As int64 As int64
last_session_end_time
Optional

Last session end time. If active flow, end_time is the flow reported time. The number of seconds since epoch.

FlowType
flow_type
Optional

Enum representing the classification of a network flow based on firewall rule action.

Enumeration: UNKNOWN, UN_MICROSEGMENTED, BLOCKED, ALLOWED, VDS
FlowTrafficType
flow_traffic_type
Optional

Flow traffic type if it was UNICAST/MULTICAST/BROADCAST.

Enumeration: INVALID, UCAST, MCAST, BCAST
boolean
is_active
Optional

Whether the flow is active or completed.

Property Of