Traffic analysis

Traffic Queries

You can use the PCE API to search the traffic database for flows matching specific criteria. The traffic query endpoints provide the same interface as the Explorer feature in the PCE.

Note

The synchronous traffic query endpoint and get_traffic_flows function are deprecated - use the async endpoint and get_traffic_flows_async function instead. See the Explorer REST API docs for details.

>>> traffic_query = TrafficQuery.build(
...     start_date="2022-07-01T00:00:00Z",
...     end_date="2022-08-01T00:00:00Z",
...     include_services=[
...         {'port': 3389, 'proto': 'tcp'},
...         {'port': 3389, 'proto': 'udp'},
...     ],
...     policy_decisions=['blocked', 'potentially_blocked', 'unknown']
... )
>>> blocked_rdp_traffic = pce.get_traffic_flows_async(
...     query_name='blocked-rdp-traffic-july-22',
...     traffic_query=traffic_query
... )