From 36ee8e903775745abb256e98ced7fbcbe7494f6e Mon Sep 17 00:00:00 2001 From: Brandon Hopkins Date: Wed, 19 Aug 2026 11:49:56 -0700 Subject: [PATCH] Fix placeholders to be more generic --- .../activity/event-streaming/generic-http.mdx | 4 +-- src/pages/manage/activity/index.mdx | 6 ++-- .../activity/traffic-events-logging.mdx | 36 +++++++++---------- 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/src/pages/manage/activity/event-streaming/generic-http.mdx b/src/pages/manage/activity/event-streaming/generic-http.mdx index ab8a84c9..27988e80 100644 --- a/src/pages/manage/activity/event-streaming/generic-http.mdx +++ b/src/pages/manage/activity/event-streaming/generic-http.mdx @@ -133,10 +133,10 @@ A traffic event uses the same keys, but leaves the identity fields empty and car "meta": { "flow_id": "", "direction": "EGRESS", - "source_addr": "100.121.42.206:0", + "source_addr": "100.64.0.10:0", "source_name": "example-laptop.local", "source_type": "PEER", - "destination_addr": "100.121.255.254:0", + "destination_addr": "100.64.0.20:0", "destination_name": "", "destination_type": "PEER", "protocol": 6, diff --git a/src/pages/manage/activity/index.mdx b/src/pages/manage/activity/index.mdx index 61ac6481..51642c1a 100644 --- a/src/pages/manage/activity/index.mdx +++ b/src/pages/manage/activity/index.mdx @@ -37,7 +37,7 @@ You can work with the feed using the following controls: - **Time range.** The date picker defaults to `Last 14 Days` and offers the `All Time`, `Last Month`, `Last 14 Days`, `Yesterday`, and `Today` presets, plus a custom start and end date. Your selection is remembered in the browser. - **Filters.** The `Filters` button exposes a `Type` filter, which lets you select one or more event types grouped by category, and an `Initiator` - filter, which narrows the feed down to a single user. System generated events are listed as `NetBird` in the `Initiator` filter. + filter, which narrows the feed down to a single user. System-generated events are listed as `NetBird` in the `Initiator` filter. Active filters appear as chips above the feed. - **Reset Filters & Search** clears the search term, the filters, and the time range. - **Refresh** reloads the feed from the Management server. @@ -52,7 +52,7 @@ See [User roles](/manage/team/user-roles) for the full matrix. The same check ap ### Tracked events NetBird tracks changes that occur in the Management server, such as modifications to peers, users, groups, networks, DNS settings, -system settings, setup keys, and access control policies. Each event has a human readable name and a stable activity code. +system settings, setup keys, and access control policies. Each event has a human-readable name and a stable activity code. The activity code is what you see in the [API response](/api/resources/events) and in [streamed events](/manage/activity/event-streaming), so it is the safest value to build alerts and dashboards on. @@ -237,7 +237,7 @@ never appear in your feed. -Audit events cover configuration changes on the Management server. Connection level events, such as which peer connected to which +Audit events cover configuration changes on the Management server. Connection-level events, such as which peer connected to which resource and whether the connection was allowed or blocked, are covered by [Traffic Events Logging](/manage/activity/traffic-events-logging). diff --git a/src/pages/manage/activity/traffic-events-logging.mdx b/src/pages/manage/activity/traffic-events-logging.mdx index 655c2d5f..ca87a739 100644 --- a/src/pages/manage/activity/traffic-events-logging.mdx +++ b/src/pages/manage/activity/traffic-events-logging.mdx @@ -207,40 +207,40 @@ In addition to the data collected by the peers, the NetBird API provides additio API sample response (one entry from the data array) ```json { - "flow_id": "9682d060-3b28-4fa3-8b47-98595a51bbda", - "reporter_id": "cvco2st9q2cs73btphm0", + "flow_id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", + "reporter_id": "c1example00000000001", "source": { - "id": "cvco2st9q2cs73btphm0", + "id": "c1example00000000001", "type": "PEER", - "name": "MacBook-Pro-10.local", + "name": "example-laptop.local", "geo_location": { "city_name": "Frankfurt", "country_code": "DE" }, "os": "Darwin", - "address": "100.89.67.186:50229", - "dns_label": "macbook-pro-10-2" + "address": "100.64.0.10:50229", + "dns_label": "example-laptop" }, "destination": { - "id": "cvco2st9q2cs73btphmg", + "id": "c1example00000000002", "type": "DOMAIN_RESOURCE", - "name": "Any google.com domain", + "name": "Any example.com domain", "geo_location": { "city_name": "", "country_code": "" }, "os": "", - "address": "142.250.185.206:443", - "dns_label": "*.google.com" + "address": "203.0.113.10:443", + "dns_label": "*.example.com" }, "user": { - "id": "google-oauth2|xyz0123", + "id": "oauth2|example-idp|user-0001", "email": "john@example.com", "name": "John Doe" }, "policy": { - "id": "cvco2st9q2cs73btphn0", - "name": "Allow google access" + "id": "c1example00000000003", + "name": "Allow example.com access" }, "icmp": { "type": 0, @@ -255,16 +255,16 @@ In addition to the data collected by the peers, the NetBird API provides additio "num_of_starts": 1, "num_of_ends": 1, "num_of_drops": 0, - "window_start": "2026-03-22T20:26:16.937522Z", - "window_end": "2026-03-22T20:30:17.257891Z", + "window_start": "2026-01-15T10:00:00.000000Z", + "window_end": "2026-01-15T10:04:00.000000Z", "events": [ { "type": "TYPE_START", - "timestamp": "2026-03-22T20:26:16.937522Z" + "timestamp": "2026-01-15T10:00:00.000000Z" }, { "type": "TYPE_END", - "timestamp": "2026-03-22T20:30:17.257891Z" + "timestamp": "2026-01-15T10:04:00.000000Z" } ] } @@ -310,7 +310,7 @@ Correlate a session by comparing the aggregated flow records reported by both si ### Viewing TCP and UDP connections You can use endpoint addresses, destination ports, and the other flow fields to correlate TCP and UDP records. Below we will analyze a few examples for a connection between a user computer and Web and FTP servers. -The peer Maycons-MacBook-Pro.local initiates a connection to the Web server on destination port TCP/80. A successful aggregate has non-zero start and end counters and totals the packets and bytes transferred in the reporting window: +The peer `example-laptop.local` initiates a connection to the Web server on destination port TCP/80. A successful aggregate has non-zero start and end counters and totals the packets and bytes transferred in the reporting window:

P2P TCP Allowed