Get Apps Flow Topology
Returns a topology graph where applications are nodes and inter-application communication paths are edges. Each edge represents that at least one flow exists between two applications within the time window, with aggregated unique flow counts attached.
Notes:
start_timeis required. Eithersite_idorsite_idsmust also be provided.- Application membership is determined by the current compute-to-application mapping at query time, not at the time each flow was observed.
- Use
entity_limitto cap the number of application nodes returned (default 500). VMs and IPs that do not belong to any application are aggregated into a specialOTHER_VMS_AND_IPSnode. filtersaccepts up to 300 filter entries.- The
app-idof each application node can be used withPOST /visualization/flow-analysis/applications/{app-id}/flow-detailsto drill into flow records for that application, or withPOST /visualization/security-analysis/applications/{app-id}/related-dfw-rulesto see its associated DFW rules.
Wrapper request for AppsFlowTopology with restricted filter keys
{
"site_id": "2996d590-1afe-49a1-905b-3f39b8228da7",
"start_time": 1781807020443,
"entity_limit": 10000,
"filters": [],
"cluster_info": {
"cluster_type": "FLOW"
}
}success
{
"time_interval": {
"start_time": 1781808080000,
"end_time": 1781808524000
},
"topology": {
"partial_result": [
"GROUP_NUMBER_IN_FLOW_THRESHOLD_EXCEEDED"
],
"entities": [
{
"entity_type": "OTHER_VMS_AND_IPS",
"id": "OTHER_VMS_AND_IPS",
"reference_id": "OTHER_VMS_AND_IPS",
"name": "Other VMs & IPs",
"config_events": [],
"fw_properties": {
"ew_allowed": 12,
"ew_blocked": 0,
"ew_unmicrosegmented": 600,
"ew_vds": 0
},
"highlight": false
}
],
"connections": {
"flow_connections": [
{
"from": "OTHER_VMS_AND_IPS",
"to": "OTHER_VMS_AND_IPS",
"fw_properties": {
"ew_allowed": 0,
"ew_blocked": 0,
"ew_unmicrosegmented": 296,
"ew_vds": 0
}
}
]
},
"uuid_mapping": {},
"has_communities": false,
"communities": []
}
}Represents a continuous span of time defined by a required start and end timestamp.
The graph representation of a network topology, consisting of entities (nodes) and connections (edges) between them.
Bad Request
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Unauthorized
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Forbidden
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Precondition Failed
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Precondition Required
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Too Many Requests
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Error
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
curl -X POST -H 'Authorization: <value>' -H 'Content-Type: application/json' -d '{}' https://{api_host}/intelligence/visualization/topology/apps-flow-topology