> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.
# NetFlow Security
> Guide to integrate and utilize OneFirewall's NetFlow Security Analysis API
**NetFlow Security Analysis** is a sub-product of **OneFirewall Alliance** that provides **real-time network metadata analysis**. It gives visibility into **allowed** and **blocked** traffic at your organization's perimeter, helping identify malicious activity that bypassed traditional security controls.
> OneFirewall cross-references this traffic against threat intelligence from its Cybersecurity Alliance to flag **previously allowed traffic** that has since been identified as **malicious**.
***
## Getting Started
### 1. Account and Licensing
* An active **OneFirewall account** (on-prem or cloud).
* A **valid license** for NetFlow Security Analysis.
* **Permissions** to access API functionality.
If you don't have access, contact **OneFirewall Support**.
### 2. Generate Your API Token
Navigate to your **profile settings** on the OneFirewall platform and generate an **API token** to authorize your requests.
***
## Sending Network Metadata
To send traffic data for analysis, use the following API endpoint:
### POST Request
```
import requests
import json
url = "https://app.onefirewall.com/api/v1/poc_traffic/direct"
payload = json.dumps({
"firewall": "fortinet",
"direction": "inbound",
"dst_ip": "192.168.0.1",
"service": "org1",
"src_port": 3435,
"dst_port": 443,
"src_ip": "94.22.73.32",
"action": "Allow"
})
headers = {
'Authorization': '',
'Content-Type': 'application/json'
}
response = requests.request("POST", url, headers=headers, data=payload)
print(response.text)
```
* firewall: Name of your firewall or IPS
* direction: `inbound` or `outbound`
* src\_ip / dst\_ip: Source and destination IPv4 addresses
* src\_port / dst\_port: Source and destination port numbers
* service: Human-readable name of the service
* action: `Allow` or `Deny`
#### Response Codes
* 200 OK – Request accepted
* 201 Created – Resource created and queued for analysis
* 4xx – Error in request (e.g., malformed payload or invalid token)
#### Rate Limiting
You can send multiple requests, but be aware of the following limits:
* 150 requests per 10 seconds
* Requests beyond this rate will be throttled or rejected
### View Live Reports
After sending the traffic metadata, you can monitor results live:
1. Go to [https://app.onefirewall.com](https://app.onefirewall.com)
2. Navigate to the Live section
3. View real-time analysis and threat assessments
### What NetFlow Security Analysis Provides
* Detects malicious activity that slipped past traditional security layers
* Gives visibility into blocked and allowed traffic across your perimeter
* Uses threat intelligence from the Cybersecurity Alliance
* Supports zero-trust strategies with traffic-level data
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.