### Flow

Name            | Type      | Description
---             | ---       | ---
`ts`            | Number    | A Unix timestamp that shows  the time the flow ended
`gid`           | String    | Unique identifier of the Firewalla box that captured this flow
`protocol`      | String    | Transport protocol of this flow, either `tcp` or `udp`
`direction`     | String    | Direction of the flow, `inbound` for inbound, `outbound` for outbound, or `local` for local traffic
`block`         | Boolean   | Whether this is a blocked flow or regular flow. `true` for blocked flow
`blockType`   | String <span style="color:gray">*optional*</span>    | Type of blocked flow, either `ip` or `dns`, only returned on blocked flows
`download`   | Number <span style="color:gray">*optional*</span>    | Number of bytes downloaded, only returned on regular flows
`upload`     | Number <span style="color:gray">*optional*</span>   | Number of bytes uploaded, only returned on regular flows
`duration`   | Number <span style="color:gray">*optional*</span>   | Duration of this flow in seconds, only return on regular flows
`count`         | Number    | Number of TCP connections or UDP sessions for flow, or block count for blocked flow
`device`        | [Device](#device) | Detailed information of the monitoring device involved in this flow
`source` | [Host](#host) <span style="color:gray">*optional*</span> | Detailed information of the source host involved in this flow
`destination` | [Host](#host) <span style="color:gray">*optional*</span> | Detailed information of the destination host involved in this flow
`region`      | String <span style="color:gray">*optional*</span>    | Region of the remote IP, a 2-letter [ISO 3166 code](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2)
`category` | [Category](#category) <span style="color:gray">*optional*</span> | Remote host category, based on Firewalla cloud intel
`network`       | [Network](#network) | Network that this flow was captured on
`group` | [Group](./device.md/#group) <span style="color:gray">*optional*</span> | Group that the device belonged to when this flow was captured

### Device

Name            | Type      | Description
---             | ---       | ---
`id`            | [Device ID](./device.md/#device-id) | This device’s unique identifier
`ip`            | String    | Device IP address
`name`          | String    | Device display name

### Network

| Name   | Type   | Description                      |
| ------ | ------ | -------------------------------- |
| `id`   | String | The network’s unique identifier |
| `name` | String | Name of the network              |

### Host

Name            | Type      | Description
---             | ---       | ---
`id`            | String    | If host is a local device, it is [Device ID](./device.md/#device-id), otherwise it is remote host domain or ip
`name`          | String    | If host is a local device, it is device display name, otherwise it is remote host domain
`ip`            | String    | IP address of the host.

### Category

| Possible Values                                                                                 |
| ----------------------------------------------------------------------------------------------- |
| `ad` `edu` `games` `gamble` `intel` `p2p` `porn` `private` `social` `shopping` `video` `vpn` |