test new flow stream analysis

frontend/src/api/apiClient.ts

@@ -3,6 +3,7 @@ import axios from 'axios';
 import {
   AnomalyAnalysisResponse,
   ConversationAnalysisResponse,
+  ConversationFlowDetailResponse,
   DiscoveryAnalysisResponse,
   HostIntelligenceAnalysisResponse,
   InterfaceHostAnalysisResponse,
@@ -235,6 +236,46 @@ export const fetchConversationAnalysis = async (
   return res.data;
 };
 
+export const fetchConversationFlowDetail = async ({
+  flowId,
+  srcIpAddress,
+  srcMacAddress,
+  dstIpAddress,
+  dstMacAddress,
+  srcPort,
+  dstPort,
+  protocol,
+  sinceMinutes = null,
+  limitPackets = 1500,
+}: {
+  flowId?: string | null;
+  srcIpAddress?: string | null;
+  srcMacAddress?: string | null;
+  dstIpAddress?: string | null;
+  dstMacAddress?: string | null;
+  srcPort?: number | null;
+  dstPort?: number | null;
+  protocol?: string | null;
+  sinceMinutes?: number | null;
+  limitPackets?: number;
+}): Promise<ConversationFlowDetailResponse> => {
+  const res = await api.get<ConversationFlowDetailResponse>('/analysis/conversation-flow-detail', {
+    params: {
+      flow_id: flowId ?? undefined,
+      src_ip_address: srcIpAddress ?? undefined,
+      src_mac_address: srcMacAddress ?? undefined,
+      dst_ip_address: dstIpAddress ?? undefined,
+      dst_mac_address: dstMacAddress ?? undefined,
+      src_port: srcPort ?? undefined,
+      dst_port: dstPort ?? undefined,
+      protocol: protocol ?? undefined,
+      since_minutes: sinceMinutes ?? undefined,
+      limit_packets: limitPackets,
+    },
+  });
+  return res.data;
+};
+
 export const fetchHostIntelligenceAnalysis = async (
   sinceMinutes: number | null = null,
   limitHosts = 40,

frontend/src/types/analysis.ts

@@ -1,3 +1,5 @@
+import type { PacketRow } from './packets';
+
 export interface InterfaceHostEvidence {
   ip_address?: string | null;
   mac_address?: string | null;
@@ -94,8 +96,11 @@ export interface ConversationEvidence {
   ethernet_protocol?: string | null;
   ip_protocol?: string | null;
   hostnames: string[];
+  flow_ids: string[];
+  flow_count: number;
   packet_count: number;
   byte_count: number;
+  duration_ms: number;
   first_seen: string;
   last_seen: string;
   accept_count: number;
@@ -110,6 +115,37 @@ export interface ConversationAnalysisResponse {
   notes: string[];
 }
 
+export interface ConversationFlowSummaryEvidence {
+  flow_id: string;
+  protocol: string;
+  packet_count: number;
+  byte_count: number;
+  first_seen: string;
+  last_seen: string;
+  client_label: string;
+  server_label: string;
+  request_count: number;
+  response_count: number;
+}
+
+export interface ConversationFlowEventEvidence {
+  flow_id: string;
+  timestamp: string;
+  kind: string;
+  label: string;
+  src_label: string;
+  dst_label: string;
+  packet_id?: string | null;
+}
+
+export interface ConversationFlowDetailResponse {
+  since?: string | null;
+  packets: PacketRow[];
+  flows: ConversationFlowSummaryEvidence[];
+  events: ConversationFlowEventEvidence[];
+  notes: string[];
+}
+
 export interface LabelCountEvidence {
   label: string;
   packet_count: number;