> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries/network-flow-query-examples.md).

# Network Flow Query Examples

The following examples show you how to use [Network Flow Query Attributes](/content-collections/search-and-investigate/network-queries/network-flow-query-attributes.md) in RQL for investigating network flow issues.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>USE CASE</td><td>RQL</td></tr><tr><td>View traffic originating from the Internet &#x26; suspicious IPs to resource with Database role.</td><td><pre><code>network from vpc.flow_record where source.publicnetwork IN ( 'Suspicious IPs' , 'Internet IPs' ) and dest.resource IN ( resource where role IN ( 'AWS RDS' , 'Database' ) )
</code></pre></td></tr><tr><td>Find instances that are accessible over the Internet using insecure ports.</td><td><pre><code>network from vpc.flow_record where source.publicnetwork IN ( 'Internet IPs' ) and protocol = 'TCP' AND dest.port IN ( 21,23,80)
</code></pre></td></tr><tr><td>Find hosts with Meltdown and Spectre vulnerabilities receiving network traffic.</td><td><pre><code>network from vpc.flow_record where dest.resource IN ( resource where finding.type IN ( 'Host Vulnerability' ) AND finding.name IN ( 'CVE-2017-5754', 'CVE-2017-5753', 'CVE-2017-5715' ) )  and bytes > 0
</code></pre></td></tr><tr><td>Check for traffic categorized as malware of type DDoS, HackingTool, or Worm, originating from the Internet &#x26; suspicious IPs that are destined to your cloud assets that are not directly accessible over the Internet.</td><td><pre><code>network from vpc.flow_record where src.publicnetwork IN ('Suspicious IPs','Internet IPs') AND dest.resource IN ( resource where role not in ( 'AWS NAT Gateway' , 'AWS ELB' ) ) and protocol not in ( 'ICMP' , 'ICMP6' ) AND threat.source = 'AF' AND threat.tag.group IN ( 'DDoS', 'HackingTool', 'Worm' )
</code></pre></td></tr><tr><td>Look for traffic from Internet to any instance outside of Web servers, NAT Gateways or ELBs.</td><td><pre><code>network from vpc.flow_record where src.publicnetwork IN ('Suspicious IPs','Internet IPs') AND dest.resource IN ( resource where role not in ( 'AWS NAT Gateway' , 'AWS ELB' ) ) and protocol not in ( 'ICMP' , 'ICMP6' )
</code></pre></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries/network-flow-query-examples.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.