feat: remove traffic flow query limits to show complete flow history in dashboard and workload insights
Remove 500-flow limit from dashboard_suspicious_traffic query and 1000-flow limit from workload_insights query to display all traffic flows instead of truncated results, enabling full visibility of suspicious traffic events and workload communication patterns
This commit is contained in:
@@ -800,7 +800,7 @@ def dashboard_suspicious_traffic(db: Session) -> list[dict[str, int | str]]:
|
||||
for address in db.scalars(select(IpAddress).where(IpAddress.workload_id.is_not(None))).all()
|
||||
}
|
||||
events: dict[tuple[str, str, int], dict[str, int | str]] = {}
|
||||
for flow in db.scalars(select(TrafficFlow).order_by(TrafficFlow.updated_at.desc()).limit(500)).all():
|
||||
for flow in db.scalars(select(TrafficFlow).order_by(TrafficFlow.updated_at.desc())).all():
|
||||
port = flow.destination_port or 0
|
||||
source_internal = bool(subnet_label_for_ip(subnets, flow.source_ip))
|
||||
destination_internal = bool(subnet_label_for_ip(subnets, flow.destination_ip)) or flow.destination_ip in workload_ips
|
||||
@@ -1534,7 +1534,6 @@ async def workload_insights(workload_id: str, _: CurrentUser, db: Session = Depe
|
||||
select(TrafficFlow)
|
||||
.where((TrafficFlow.source_ip.in_(workload_ips)) | (TrafficFlow.destination_ip.in_(workload_ips)))
|
||||
.order_by((TrafficFlow.state == "blocked").desc(), TrafficFlow.updated_at.desc())
|
||||
.limit(1000)
|
||||
).all()
|
||||
for flow in flows:
|
||||
source_owner = ip_owners.get(flow.source_ip)
|
||||
|
||||
Reference in New Issue
Block a user