nessi/NexaFabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: remove traffic flow query limits to show complete flow history in dashboard and workload insights

Browse Source 
Remove 500-flow limit from dashboard_suspicious_traffic query and 1000-flow limit from workload_insights query to display all traffic flows instead of truncated results, enabling full visibility of suspicious traffic events and workload communication patterns
This commit is contained in:
nessi
2026-07-10 08:16:53 +02:00
parent 67eee0662a
commit 9af60945cf
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/api/v1/router.py
+1 -2
View File
@@ -800,7 +800,7 @@ def dashboard_suspicious_traffic(db: Session) -> list[dict[str, int | str]]:
for address in db.scalars(select(IpAddress).where(IpAddress.workload_id.is_not(None))).all() for address in db.scalars(select(IpAddress).where(IpAddress.workload_id.is_not(None))).all()
} }
events: dict[tuple[str, str, int], dict[str, int | str]] = {} events: dict[tuple[str, str, int], dict[str, int | str]] = {}
for flow in db.scalars(select(TrafficFlow).order_by(TrafficFlow.updated_at.desc()).limit(500)).all(): for flow in db.scalars(select(TrafficFlow).order_by(TrafficFlow.updated_at.desc())).all():
port = flow.destination_port or 0 port = flow.destination_port or 0
source_internal = bool(subnet_label_for_ip(subnets, flow.source_ip)) source_internal = bool(subnet_label_for_ip(subnets, flow.source_ip))
destination_internal = bool(subnet_label_for_ip(subnets, flow.destination_ip)) or flow.destination_ip in workload_ips destination_internal = bool(subnet_label_for_ip(subnets, flow.destination_ip)) or flow.destination_ip in workload_ips
@@ -1534,7 +1534,6 @@ async def workload_insights(workload_id: str, _: CurrentUser, db: Session = Depe
select(TrafficFlow) select(TrafficFlow)
.where((TrafficFlow.source_ip.in_(workload_ips)) | (TrafficFlow.destination_ip.in_(workload_ips))) .where((TrafficFlow.source_ip.in_(workload_ips)) | (TrafficFlow.destination_ip.in_(workload_ips)))
.order_by((TrafficFlow.state == "blocked").desc(), TrafficFlow.updated_at.desc()) .order_by((TrafficFlow.state == "blocked").desc(), TrafficFlow.updated_at.desc())
.limit(1000)
).all() ).all()
for flow in flows: for flow in flows:
source_owner = ip_owners.get(flow.source_ip) source_owner = ip_owners.get(flow.source_ip)