​

ves-io-schema-flow-CustomAPI-TopFlowAnomalies

Published April 5, 2023 | Last modified October 28, 2026

Examples of performing flow CustomAPI TopFlowAnomalies

Usecase:

Top Flow Anomalies

Request:

Request using vesctl:

vesctl request rpc flow.CustomAPI.TopFlowAnomalies -i request.yaml --uri /public/namespaces/system/flows/top_flow_anomalies --http-method POST

where file request.yaml has following contents:

endTime: "1593622800"
fieldSelector:
- BYTES
filter: '{SITE="site-1"}'
groupBy:
- SRC_IP
- SRC_PORT
startTime: "1593619200"

vesctl yaml response:

flowAnomalyData:
- anomalyData:
  - anomalousDataTransferred: "400000"
    anomalyDurationSeconds: "300"
    anomalyLevel: HIGH_ANOMALY_LEVEL
    anomalyScore: 95.5
    anomalyStartTime: "2026-09-28T04:25:15.492983Z"
    labels:
      DST_IP: 789.789.789.789
      DST_NETWORK: nw2
      DST_PORT: "9090"
      DST_PROVIDER_TYPE: type-b
      DST_SITE: site2
      DST_SUBNET: 210.210.210.0
      PROTOCOL: TCP
      SITE: test_site
      SRC_IP: 123.123.123.123
      SRC_NETWORK: nw1
      SRC_PORT: "8080"
      SRC_PROVIDER_TYPE: type-a
      SRC_SITE: site1
      SRC_SUBNET: 255.255.255.0
    scanTime: "2026-09-28T04:25:15.492983Z"
    totalDataTransferred: "500000"

Request using curl:

curl -X 'POST' -d '{"filter":"{SITE=\"site-1\"}","field_selector":["BYTES"],"start_time":"1593619200","end_time":"1593622800","group_by":["SRC_IP","SRC_PORT"]}' -H 'Content-Type: application/json' -H 'X-Volterra-Useragent: v1/pgm=_var_folders_q2_3kp8z3zs0x5_m7pk1bgb0_ph0000gp_T_go-build3348201650_b001_apidocs.test/host=MTY6VVHQPH/svc=S:examplesvc/site=mytestce01' 'https://acmecorp.console.ves.volterra.io/api/data/namespaces/system/flows/top_flow_anomalies'

curl response:

HTTP/1.1 200 OK
Content-Length: 1035
Content-Type: application/json
Date: Mon, 28 Sep 2026 04:25:15 GMT
Vary: Accept-Encoding


{
  "flowAnomalyData": [
    {
      "type": "BYTES",
      "anomaly_data": [
        {
          "labels": {
            "DST_IP": "789.789.789.789",
            "DST_NETWORK": "nw2",
            "DST_PORT": "9090",
            "DST_PROVIDER_TYPE": "type-b",
            "DST_SITE": "site2",
            "DST_SUBNET": "210.210.210.0",
            "PROTOCOL": "TCP",
            "SITE": "test_site",
            "SRC_IP": "123.123.123.123",
            "SRC_NETWORK": "nw1",
            "SRC_PORT": "8080",
            "SRC_PROVIDER_TYPE": "type-a",
            "SRC_SITE": "site1",
            "SRC_SUBNET": "255.255.255.0"
          },
          "anomaly_start_time": "2026-09-28T04:25:15.492983Z",
          "anomaly_duration_seconds": "300",
          "anomalous_data_transferred": "400000",
          "anomaly_level": "HIGH_ANOMALY_LEVEL",
          "total_data_transferred": "500000",
          "scan_time": "2026-09-28T04:25:15.492983Z",
          "anomaly_score": 95.5,
          "flow_count": "0"
        }
      ]
    }
  ]
}
On this page: