> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries.md). # Network Queries Use network queries to find real-time network security risks on your assets deployed in public cloud environments. Prisma Cloud identifies anomalies in ingested network traffic data using Machine Learning to help you conduct network investigation and analysis. With Prisma Cloud you can query network traffic from VPC flow logs in extensive detail using pre-defined or custom queries. Set up queries for conditions you want to be alerted on, such as services that are exposed to the internet, communicating with suspicious IPs or communicating outside of approved guardrails. Network queries are based on varying RQL and data sources and can be of two types: * Network Flow - Query for incidents and threats that are based on flow logs. * Network Configuration - Query for true exposures that are based on configuration. These queries help you monitor network traffic and explore the inter-connectivity of your cloud resources by account and region using data points such as, packets, bytes, source or destination resource, source or destination IP address, and source or destination port information. The intelligent Investigate Graph brings traffic into context by automatically grouping assets into their parent relationships. For every IP address associated with a Prisma Cloud monitored asset, the graph automatically builds a top down hierarchy. This provides a visual representation of where an asset is deployed, how critical that environment is, and if flows represent a risk or anomaly requiring further investigation. Flows are further separated into two different swimlanes: * External → Flows coming from/going to unmanaged IPs * Your Environment → Flows coming from/going to assets known to Prisma Cloud External IPs are grouped by a parent related to the specific IP CIDR block or Threat Feed. The supported groups are: * AWS → Public IPs associated to an AWS Service * AZURE → Public IPs associated to an Azure Service * GCP → Public IPs associate to a GCP Service * Suspicious IPS → Public IPs associate with a Threat List * Internet → All other public IPs ## Analyzing Network Flows To analyze a specific network traffic of interest, expand the graph to the asset level. Select a connecting line between the External IP and the asset of interest. Select **View Details**, on **Connection Details** to display an aggregated visualization of all flows between the selected asset and its related source(s) or destination(s). If the traffic is from a suspicious IP address as characterized by a threat feed, additional details for the threat feed source, such as when it was classified and reason for classification is also provided. If the side panel is empty, you may have to click on a parent group instead of an individual asset. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.