> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries.md).

# Network Queries

Use network queries to find real-time network security risks on your assets deployed in public cloud environments.

Prisma Cloud identifies anomalies in ingested network traffic data using Machine Learning to help you conduct network investigation and analysis. With Prisma Cloud you can query network traffic from VPC flow logs in extensive detail using pre-defined or custom queries. Set up queries for conditions you want to be alerted on, such as services that are exposed to the internet, communicating with suspicious IPs or communicating outside of approved guardrails.

Network queries are based on varying RQL and data sources and can be of two types:

* Network Flow - Query for incidents and threats that are based on flow logs.
* Network Configuration - Query for true exposures that are based on configuration.

These queries help you monitor network traffic and explore the inter-connectivity of your cloud resources by account and region using data points such as, packets, bytes, source or destination resource, source or destination IP address, and source or destination port information.

The intelligent Investigate Graph brings traffic into context by automatically grouping assets into their parent relationships. For every IP address associated with a Prisma Cloud monitored asset, the graph automatically builds a top down hierarchy. This provides a visual representation of where an asset is deployed, how critical that environment is, and if flows represent a risk or anomaly requiring further investigation.

Flows are further separated into two different swimlanes:

* External → Flows coming from/going to unmanaged IPs
* Your Environment → Flows coming from/going to assets known to Prisma Cloud

External IPs are grouped by a parent related to the specific IP CIDR block or Threat Feed. The supported groups are:

* AWS → Public IPs associated to an AWS Service
* AZURE → Public IPs associated to an Azure Service
* GCP → Public IPs associate to a GCP Service
* Suspicious IPS → Public IPs associate with a Threat List
* Internet → All other public IPs

## Analyzing Network Flows

To analyze a specific network traffic of interest, expand the graph to the asset level. Select a connecting line between the External IP and the asset of interest. Select **View Details**, on **Connection Details** to display an aggregated visualization of all flows between the selected asset and its related source(s) or destination(s). If the traffic is from a suspicious IP address as characterized by a threat feed, additional details for the threat feed source, such as when it was classified and reason for classification is also provided.

If the side panel is empty, you may have to click on a parent group instead of an individual asset.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.