---
title: "Automate continuous firewall traffic monitoring to detect threats faster"
canonical: "https://docs.devo.com/space/latest/95215607/Automate%20continuous%20firewall%20traffic%20monitoring%20to%20detect%20threats%20faster"
format: markdown
---
> Macro (toc)
> Macro (widget)
## Description
This Flow allows you to monitor all the traffic from your firewall by correlating it against a table that contains malicious IP addresses. If there is a match, Flow will generate an enriched event that will be logged in a designated **my.app** table. From this new table, you can take further action by creating detection rules to identify threats that put your organization at risk.
## Flow configuration
> Macro (rw-ui-tabs-macro)
>
> > Macro (rw-tab)
>
> Before defining the units of the Flow, we need to upload a lookup table to Devo that we will use to compare and match with the firewall data in our Devo domain. To do it:
>
> 1. Download the sample .csv file that we will upload as a lookup table.
> 2. Now, access your Devo domain and go to **Data search Lookup management**.
> 3. Click **New lookup**. Give a Name to the lookup (in this example, we called it *matchme*) and drag the .csv file.
> 4. Click **Create lookup**.
>
> To learn more about lookups in Devo, go to[Data enrichment](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95203983).
>
> > Macro (rw-tab)
>
> The following table describes the units needed to create this Flow, as well as how to configure and link them.
>
> | **Unit type and description** | **Configuration** |
> | --- | --- |
> | *Generator*
The events fired by this unit will activate the whole Flow. | 1. Drag a *Generator* unit to the canvas and open its configuration options by double-clicking it.
> 2. Add a **Name **to the unit (in this example, we called it *Generator*).
> 3. In the **Total Events **field, add the total number of events to be emitted. Use negative numbers (-1) to allow an unlimited amount of events.
> 4. Leave the rest of the settings as default and click **Apply** to save the configuration. |
> | *Devo Full Query*
We will use this unit to query events from the CSV file we uploaded to Devo, including potentially dangerous IP addresses.
We will later compare this list with the IP addresses with a table in Devo that contains firewall traffic in order to check if there's any match. | 1. Drag a *Devo Full Query *unit to the canvas and open the configuration options of the unit by double-clicking it.
> 2. In the **General **tab, add a **Name **to the unit (in this example, we called it *LookupQuery*).
> 3. Enter the following in the **Query **field, which references the CSV file we upload as a lookup previously:
> `from my.lookuplist.matchme `
> `select eventdate, evil_ip`
> 4. In the **Start time** and **End time** fields, enter a time range that shows events in the lookup table.
> 5. Click **Apply** to save the configuration. |
> | *Devo Source*
We will use this unit to run a query in the **firewall.all.traffic** table of our domain, which contains traffic information from our firewall.
We will compare these results with the .csv file we uploaded and check if there's any match. | 1. Drag a *Devo Source *unit to the canvas and open its configuration options by double-clicking it.
> 2. In the **General** tab, add a **Name **to the unit (in this example, we called it *FirewallQuery*).
> 3. Enter the following in the **Query **field:
> `from firewall.all.traffic select *`
> 4. Click **Apply** to save the configuration. |
> | *Lookup*
We will use this *Lookup *unit to compare the data from our csv with the firewall traffic data and check if there's any match. | 1. Drag a *Lookup *unit to the canvas and open its configuration options by double-clicking it.
> 2. Add a **Name **to the unit (in this example, we called it *IpLookups*).
> 3. Then, fill these fields with the following values:
> - **Key fields**: *srcIp*
> - **Lookup key fields: ***evil_ip*
> - **Lookup value field: ***evil_ip*
> - **Expiration time: ***0*
> - **Lookup timestamp field: ***eventdate*
> - **Timestamp field: ***eventdate*
> - **Output field name: ***evil_ip*
>
> 4. Click **Apply** to save the configuration. |
> | *Devo Sink*
This unit allows us to specify and create a new **my.app** table that will contain all the possible matches between the firewall query and the query containing the .csv IP addresses. | 1. Drag a *Devo Sink *unit to the canvas and open its configuration options by double-clicking it.
> 2. Add a **Name **to the unit (in this example, we called it *MySink*).
> 3. Then, enter *my.app.evil_ip.test* as **Table name** and select *eventdate* as the **Time field name**.
> 4. Click **Apply** to save the configuration. |
>
> > Macro (rw-tab)
>
> Once you have added and configured all the units of the Flow, you must link them as follows:
>
> ### Step 1
>
> First, link the *out *port of the *Generator *unit to the *in* port of the *Devo Full Query*. This link will send an event to activate the query.
>
> ### Step 2
>
> Now, we need to link the *Devo Full Query* unit to the *Lookup *unit to feed the lookup with our query data. To do it, create these links:
>
> - Link the *init *port of the *Devo Full Query* unit to the *clear *port of the *Lookup *unit. We need this link to reset the content of the lookup each time you activate the Flow.
> - Then, link the *init *port of the *Devo Full Query *unit to the *begin *port of the *Lookup *unit. This will make the lookup start receiving new data each time a query starts. You must create this link after the previous one.
> - Link the *data *port of the *Devo Full Query* unit to the *update *port of the *Lookup *unit. This will update the content of the lookup with the query data.
> - Finally, link the*end *port of the *Devo Full Query*unit to the *end *port of the*Lookup* unit. This will make the lookup stop receiving data when the query finishes.
>
> ###
> Step 3
>
> Now, we need to include the *Devo Source *unit.
>
> - Link the *data *port of the*Devo Source* unit to the *in *port of the *Lookup *unit.
>
> ### Step 4
>
> Finally, link the *out *port of the *Lookup *unit to the *in *port of the *Devo Sink* unit. This will send the matched values to the **my.app** table specified in the *Devo Sink *unit.
## Result
Once you're done, remember to save your Flow so you can start running it. To do it, click the **Save **button on the Flow toolbar.
Once you have defined the whole Flow and saved it, click the **Start**button to activate it. If everything is correctly configured, the Flow will send an email to the given addresses every time an inactivity period is detected.
### Import this Flow
Download this Flow in JSON formatand import it to your domain clicking the **Import from JSON** option in the **File **menu. If the JSON object opens on a new browser window automatically, copy all the content, paste it into your notepad and save it in .txt or .json format.