Network signals

Network signals describe Network Intelligence records. A record counts the traffic from one provider to one destination within one hour. Network rules require Network Intelligence access.

Use Network fields

network.subject:examp1e.com AND network.allowed_hits:>0

network.provider:cloudflare_gateway AND
network.blocked_hits:>=10

Conditions within the Network namespace must match the same record. Every field needs the network. prefix.

network.destination is the registrable domain, or the IP address when no host was named. network.subject is the registrable domain only, and is absent for traffic to a bare IP address.

Note

A network rule reads only Network fields; it can’t be combined with Domain, Email, or Canary conditions. It evaluates each record as it lands rather than searching back over a lookback window. See Network rules.

Browse signals

12 signals

Network events 12

network.observed_on date

Start of the hour the traffic was seen in

network.first_seen_on date

Earliest traffic within the hour

network.last_seen_on date

Latest traffic within the hour

network.provider keyword

Service the telemetry was read from

network.kind keyword

What the hour counts: dns, http, tls or flow

network.destination string

Registrable domain reached, or the IP address when no host was named

network.subject string

Registrable domain reached; absent for traffic to a bare IP address

network.hosts array<string>

Sample of the host names reached under the destination

network.ips array<inet>

Sample of the IP addresses reached

network.hits number

Queries, requests, handshakes or flows in the hour

network.allowed_hits number

Hits the provider allowed

network.blocked_hits number

Hits the provider blocked

Related references

• Network Intelligence
• Rules across namespaces
• All namespaces