| 1 | { |
| 2 | "status": 200, |
| 3 | "type": "topology", |
| 4 | "has_history": false, |
| 5 | "update_every": 1, |
| 6 | "data": { |
| 7 | "schema_version": "netdata.topology.v1", |
| 8 | "producer": { |
| 9 | "source": "network-connections", |
| 10 | "instance": "sample-node", |
| 11 | "node_id": "node-a", |
| 12 | "machine_guid": "machine-a", |
| 13 | "agent_version": "test", |
| 14 | "plugin": "network-viewer.plugin", |
| 15 | "capabilities": ["topology-v1"] |
| 16 | }, |
| 17 | "collected_at": "2026-05-09T00:00:00Z", |
| 18 | "view": { |
| 19 | "id": "process-connections", |
| 20 | "scope": "process_name", |
| 21 | "mode": "detailed", |
| 22 | "group_by": ["process_name"] |
| 23 | }, |
| 24 | "dictionaries": { |
| 25 | "strings": [ |
| 26 | "self", |
| 27 | "process", |
| 28 | "endpoint", |
| 29 | "node-a", |
| 30 | "machine-a", |
| 31 | "curl", |
| 32 | "198.51.100.10", |
| 33 | "socket", |
| 34 | "192.0.2.10", |
| 35 | "tcp", |
| 36 | "established", |
| 37 | "public", |
| 38 | "ownership", |
| 39 | "endpoint_socket", |
| 40 | "socket_exact", |
| 41 | "network_socket", |
| 42 | "correlated_socket", |
| 43 | "active" |
| 44 | ] |
| 45 | }, |
| 46 | "types": { |
| 47 | "actor_types": { |
| 48 | "self": { |
| 49 | "layer": "node", |
| 50 | "identity": ["id"], |
| 51 | "merge_identity": ["machine_guid", "hostname"], |
| 52 | "aggregation_scopes": ["node"] |
| 53 | }, |
| 54 | "process": { |
| 55 | "layer": "process", |
| 56 | "identity": ["id"], |
| 57 | "merge_identity": ["machine_guid", "process"], |
| 58 | "aggregation_scopes": ["node", "process_name", "pid"], |
| 59 | "presentation": { |
| 60 | "label": "Process", |
| 61 | "color_slot": "primary", |
| 62 | "size": {"mode": "metric", "metric_column": "socket_count"}, |
| 63 | "ports": { |
| 64 | "show_bullets": true, |
| 65 | "sources": [ |
| 66 | { |
| 67 | "source": "actor_table", |
| 68 | "table": "socket_ports", |
| 69 | "actor_column": "actor", |
| 70 | "name_column": "port", |
| 71 | "value_column": "socket_count", |
| 72 | "default_type": "topology" |
| 73 | } |
| 74 | ] |
| 75 | } |
| 76 | } |
| 77 | }, |
| 78 | "endpoint": { |
| 79 | "layer": "network", |
| 80 | "identity": ["id"], |
| 81 | "merge_identity": ["ip", "address_space"], |
| 82 | "aggregation_scopes": ["node"] |
| 83 | } |
| 84 | }, |
| 85 | "link_types": { |
| 86 | "ownership": { |
| 87 | "orientation": "hierarchical", |
| 88 | "direction_role": "ownership", |
| 89 | "aggregation": {"direction": "preserve", "evidence": "count"}, |
| 90 | "presentation": { |
| 91 | "label": "Process ownership", |
| 92 | "color_slot": "dim", |
| 93 | "opacity": "faded", |
| 94 | "line_style": "dotted", |
| 95 | "width": "thin", |
| 96 | "arrow": "none", |
| 97 | "layout": {"strength": "normal", "distance": "normal"} |
| 98 | } |
| 99 | }, |
| 100 | "socket": { |
| 101 | "orientation": "directed", |
| 102 | "direction_role": "dependency", |
| 103 | "aggregation": { |
| 104 | "direction": "preserve", |
| 105 | "evidence": "append", |
| 106 | "metrics": { |
| 107 | "socket_count": "sum", |
| 108 | "evidence_count": "sum", |
| 109 | "retransmissions": "sum", |
| 110 | "rtt_ms_max": "max", |
| 111 | "recv_rtt_ms_max": "max" |
| 112 | } |
| 113 | }, |
| 114 | "evidence_types": ["socket"], |
| 115 | "presentation": { |
| 116 | "label": "Local socket", |
| 117 | "color_slot": "gray", |
| 118 | "line_style": "solid", |
| 119 | "width": "thin", |
| 120 | "arrow": "forward", |
| 121 | "layout": {"strength": "normal", "distance": "normal"} |
| 122 | } |
| 123 | }, |
| 124 | "endpoint_socket": { |
| 125 | "orientation": "directed", |
| 126 | "direction_role": "dependency", |
| 127 | "aggregation": { |
| 128 | "direction": "preserve", |
| 129 | "evidence": "append", |
| 130 | "metrics": { |
| 131 | "socket_count": "sum", |
| 132 | "evidence_count": "sum", |
| 133 | "retransmissions": "sum", |
| 134 | "rtt_ms_max": "max", |
| 135 | "recv_rtt_ms_max": "max" |
| 136 | } |
| 137 | }, |
| 138 | "evidence_types": ["socket"], |
| 139 | "presentation": { |
| 140 | "label": "Endpoint connection", |
| 141 | "color_slot": "primary", |
| 142 | "line_style": "solid", |
| 143 | "width": "thin", |
| 144 | "arrow": "forward", |
| 145 | "layout": {"strength": "normal", "distance": "normal"} |
| 146 | } |
| 147 | }, |
| 148 | "correlated_socket": { |
| 149 | "orientation": "directed", |
| 150 | "direction_role": "dependency", |
| 151 | "aggregation": { |
| 152 | "direction": "preserve", |
| 153 | "evidence": "append", |
| 154 | "metrics": { |
| 155 | "socket_count": "sum", |
| 156 | "evidence_count": "sum", |
| 157 | "retransmissions": "sum", |
| 158 | "rtt_ms_max": "max", |
| 159 | "recv_rtt_ms_max": "max" |
| 160 | } |
| 161 | }, |
| 162 | "evidence_types": ["socket"], |
| 163 | "presentation": { |
| 164 | "label": "Correlated socket", |
| 165 | "color_slot": "primary", |
| 166 | "line_style": "solid", |
| 167 | "width": "thin", |
| 168 | "arrow": "forward", |
| 169 | "layout": {"strength": "normal", "distance": "farthest"} |
| 170 | } |
| 171 | } |
| 172 | }, |
| 173 | "port_types": { |
| 174 | "topology": { |
| 175 | "presentation": { |
| 176 | "label": "Socket", |
| 177 | "color_slot": "primary" |
| 178 | } |
| 179 | } |
| 180 | }, |
| 181 | "evidence_types": { |
| 182 | "socket": { |
| 183 | "link_type": "socket", |
| 184 | "role": "relationship_evidence", |
| 185 | "match_columns": [ |
| 186 | "client_ip", |
| 187 | "client_port", |
| 188 | "server_ip", |
| 189 | "server_port", |
| 190 | "protocol" |
| 191 | ], |
| 192 | "columns": [ |
| 193 | {"id": "link", "type": "link_ref", "role": "reference"}, |
| 194 | {"id": "src_actor", "type": "actor_ref", "role": "reference"}, |
| 195 | {"id": "dst_actor", "type": "actor_ref", "role": "reference"}, |
| 196 | {"id": "client_ip", "type": "ip_ref", "dictionary": "strings", "role": "group_key"}, |
| 197 | {"id": "client_port", "type": "uint", "role": "group_key"}, |
| 198 | {"id": "server_ip", "type": "ip_ref", "dictionary": "strings", "role": "group_key"}, |
| 199 | {"id": "server_port", "type": "uint", "role": "group_key"}, |
| 200 | {"id": "protocol", "type": "string_ref", "dictionary": "strings", "role": "group_key"}, |
| 201 | {"id": "state", "type": "string_ref", "dictionary": "strings"} |
| 202 | ] |
| 203 | } |
| 204 | }, |
| 205 | "table_types": { |
| 206 | "socket_ports": { |
| 207 | "role": "actor_inventory", |
| 208 | "owner": "actor", |
| 209 | "aggregation": "sum", |
| 210 | "columns": [ |
| 211 | {"id": "actor", "type": "actor_ref", "role": "reference"}, |
| 212 | {"id": "port", "type": "uint", "role": "group_key"}, |
| 213 | {"id": "protocol", "type": "string_ref", "dictionary": "strings", "role": "group_key"}, |
| 214 | {"id": "socket_count", "type": "uint", "role": "metric", "aggregation": "sum"} |
| 215 | ] |
| 216 | }, |
| 217 | "connections": { |
| 218 | "role": "relationship_summary", |
| 219 | "owner": "link", |
| 220 | "aggregation": "merge_metrics", |
| 221 | "columns": [ |
| 222 | {"id": "src_actor", "type": "actor_ref", "role": "reference"}, |
| 223 | {"id": "dst_actor", "type": "actor_ref", "role": "reference"}, |
| 224 | {"id": "client_ip", "type": "ip_ref", "dictionary": "strings", "role": "group_key"}, |
| 225 | {"id": "server_ip", "type": "ip_ref", "dictionary": "strings", "role": "group_key"}, |
| 226 | {"id": "protocol", "type": "string_ref", "dictionary": "strings", "role": "group_key"}, |
| 227 | {"id": "state", "type": "string_ref", "dictionary": "strings"}, |
| 228 | {"id": "socket_count", "type": "uint", "role": "metric", "aggregation": "sum"} |
| 229 | ] |
| 230 | } |
| 231 | } |
| 232 | }, |
| 233 | "presentation": { |
| 234 | "legend": { |
| 235 | "actors": [ |
| 236 | {"type": "self", "label": "Node"}, |
| 237 | {"type": "process", "label": "Process"}, |
| 238 | {"type": "endpoint", "label": "Correlation endpoint"} |
| 239 | ], |
| 240 | "links": [ |
| 241 | {"type": "ownership", "label": "Process ownership"}, |
| 242 | {"type": "endpoint_socket", "label": "Endpoint connection"}, |
| 243 | {"type": "correlated_socket", "label": "Correlated socket"} |
| 244 | ] |
| 245 | }, |
| 246 | "port_fields": [ |
| 247 | {"key": "type", "label": "Type"}, |
| 248 | {"key": "socket_count", "label": "Sockets"} |
| 249 | ], |
| 250 | "scale_keys": { |
| 251 | "sockets": {"label": "Sockets", "unit": "count"} |
| 252 | } |
| 253 | }, |
| 254 | "correlation": { |
| 255 | "rules": { |
| 256 | "socket_exact": { |
| 257 | "action": "absorb", |
| 258 | "priority": 1, |
| 259 | "key_space": "network_socket", |
| 260 | "key": [ |
| 261 | {"column": "protocol"}, |
| 262 | {"literal": ":"}, |
| 263 | {"column": "address_space"}, |
| 264 | {"literal": ":"}, |
| 265 | {"column": "ip"}, |
| 266 | {"literal": ":"}, |
| 267 | {"column": "port"} |
| 268 | ], |
| 269 | "point_actor_types": ["endpoint"], |
| 270 | "claim_actor_types": ["process"], |
| 271 | "correlation_link_types": ["endpoint_socket"], |
| 272 | "output_link_type": "correlated_socket" |
| 273 | } |
| 274 | }, |
| 275 | "points": { |
| 276 | "rows": 1, |
| 277 | "columns": [ |
| 278 | {"id": "actor", "type": "actor_ref", "role": "reference"}, |
| 279 | {"id": "rule", "type": "string_ref", "dictionary": "strings"}, |
| 280 | {"id": "protocol", "type": "string_ref", "dictionary": "strings"}, |
| 281 | {"id": "address_space", "type": "string_ref", "dictionary": "strings"}, |
| 282 | {"id": "ip", "type": "ip_ref", "dictionary": "strings"}, |
| 283 | {"id": "port", "type": "uint"} |
| 284 | ], |
| 285 | "values": [ |
| 286 | {"codec": "const", "value": 2}, |
| 287 | {"codec": "const", "value": 14}, |
| 288 | {"codec": "const", "value": 9}, |
| 289 | {"codec": "const", "value": 11}, |
| 290 | {"codec": "const", "value": 6}, |
| 291 | {"codec": "const", "value": 443} |
| 292 | ] |
| 293 | }, |
| 294 | "claims": { |
| 295 | "rows": 1, |
| 296 | "columns": [ |
| 297 | {"id": "actor", "type": "actor_ref", "role": "reference"}, |
| 298 | {"id": "rule", "type": "string_ref", "dictionary": "strings"}, |
| 299 | {"id": "protocol", "type": "string_ref", "dictionary": "strings"}, |
| 300 | {"id": "address_space", "type": "string_ref", "dictionary": "strings"}, |
| 301 | {"id": "ip", "type": "ip_ref", "dictionary": "strings"}, |
| 302 | {"id": "port", "type": "uint"} |
| 303 | ], |
| 304 | "values": [ |
| 305 | {"codec": "const", "value": 1}, |
| 306 | {"codec": "const", "value": 14}, |
| 307 | {"codec": "const", "value": 9}, |
| 308 | {"codec": "const", "value": 11}, |
| 309 | {"codec": "const", "value": 8}, |
| 310 | {"codec": "const", "value": 43000} |
| 311 | ] |
| 312 | } |
| 313 | }, |
| 314 | "actors": { |
| 315 | "rows": 3, |
| 316 | "columns": [ |
| 317 | {"id": "type", "type": "string_ref", "dictionary": "strings"}, |
| 318 | {"id": "id", "type": "string_ref", "dictionary": "strings", "role": "identity"}, |
| 319 | {"id": "machine_guid", "type": "string_ref", "dictionary": "strings", "nullable": true}, |
| 320 | {"id": "process", "type": "string_ref", "dictionary": "strings", "nullable": true}, |
| 321 | {"id": "ip", "type": "ip_ref", "dictionary": "strings", "nullable": true}, |
| 322 | {"id": "address_space", "type": "string_ref", "dictionary": "strings", "nullable": true}, |
| 323 | {"id": "socket_count", "type": "uint", "role": "metric", "aggregation": "sum"} |
| 324 | ], |
| 325 | "values": [ |
| 326 | {"codec": "dict", "values": [0, 1, 2], "indexes": [0, 1, 2]}, |
| 327 | {"codec": "values", "values": [3, 5, 6]}, |
| 328 | {"codec": "values", "values": [4, 4, null]}, |
| 329 | {"codec": "values", "values": [null, 5, null]}, |
| 330 | {"codec": "values", "values": [null, null, 6]}, |
| 331 | {"codec": "values", "values": [null, null, 11]}, |
| 332 | {"codec": "values", "values": [2, 2, 2]} |
| 333 | ] |
| 334 | }, |
| 335 | "links": { |
| 336 | "rows": 2, |
| 337 | "columns": [ |
| 338 | {"id": "src_actor", "type": "actor_ref", "role": "reference"}, |
| 339 | {"id": "dst_actor", "type": "actor_ref", "role": "reference"}, |
| 340 | {"id": "type", "type": "string_ref", "dictionary": "strings"}, |
| 341 | {"id": "protocol", "type": "string_ref", "dictionary": "strings", "nullable": true}, |
| 342 | {"id": "state", "type": "string_ref", "dictionary": "strings", "nullable": true}, |
| 343 | {"id": "evidence_count", "type": "uint", "role": "metric", "aggregation": "sum"}, |
| 344 | {"id": "socket_count", "type": "uint", "role": "metric", "aggregation": "sum"}, |
| 345 | {"id": "retransmissions", "type": "uint", "role": "metric", "aggregation": "sum"}, |
| 346 | {"id": "rtt_ms_max", "type": "float", "role": "metric", "aggregation": "max"}, |
| 347 | {"id": "recv_rtt_ms_max", "type": "float", "role": "metric", "aggregation": "max"} |
| 348 | ], |
| 349 | "values": [ |
| 350 | {"codec": "values", "values": [0, 1]}, |
| 351 | {"codec": "values", "values": [1, 2]}, |
| 352 | {"codec": "values", "values": [12, 13]}, |
| 353 | {"codec": "values", "values": [null, 9]}, |
| 354 | {"codec": "values", "values": [17, 10]}, |
| 355 | {"codec": "values", "values": [0, 2]}, |
| 356 | {"codec": "values", "values": [2, 2]}, |
| 357 | {"codec": "values", "values": [0, 0]}, |
| 358 | {"codec": "values", "values": [0, 5.5]}, |
| 359 | {"codec": "values", "values": [0, 4.2]} |
| 360 | ] |
| 361 | }, |
| 362 | "tables": { |
| 363 | "actor": { |
| 364 | "socket_ports": { |
| 365 | "type": "socket_ports", |
| 366 | "table": { |
| 367 | "rows": 1, |
| 368 | "columns": [ |
| 369 | {"id": "actor", "type": "actor_ref", "role": "reference"}, |
| 370 | {"id": "port", "type": "uint", "role": "group_key"}, |
| 371 | {"id": "protocol", "type": "string_ref", "dictionary": "strings", "role": "group_key"}, |
| 372 | {"id": "socket_count", "type": "uint", "role": "metric", "aggregation": "sum"} |
| 373 | ], |
| 374 | "values": [ |
| 375 | {"codec": "const", "value": 1}, |
| 376 | {"codec": "const", "value": 43000}, |
| 377 | {"codec": "const", "value": 9}, |
| 378 | {"codec": "const", "value": 2} |
| 379 | ] |
| 380 | } |
| 381 | } |
| 382 | }, |
| 383 | "relationship": { |
| 384 | "connections": { |
| 385 | "type": "connections", |
| 386 | "table": { |
| 387 | "rows": 1, |
| 388 | "columns": [ |
| 389 | {"id": "src_actor", "type": "actor_ref", "role": "reference"}, |
| 390 | {"id": "dst_actor", "type": "actor_ref", "role": "reference"}, |
| 391 | {"id": "client_ip", "type": "ip_ref", "dictionary": "strings", "role": "group_key"}, |
| 392 | {"id": "server_ip", "type": "ip_ref", "dictionary": "strings", "role": "group_key"}, |
| 393 | {"id": "protocol", "type": "string_ref", "dictionary": "strings", "role": "group_key"}, |
| 394 | {"id": "state", "type": "string_ref", "dictionary": "strings"}, |
| 395 | {"id": "socket_count", "type": "uint", "role": "metric", "aggregation": "sum"} |
| 396 | ], |
| 397 | "values": [ |
| 398 | {"codec": "const", "value": 1}, |
| 399 | {"codec": "const", "value": 2}, |
| 400 | {"codec": "const", "value": 8}, |
| 401 | {"codec": "const", "value": 6}, |
| 402 | {"codec": "const", "value": 9}, |
| 403 | {"codec": "const", "value": 10}, |
| 404 | {"codec": "const", "value": 2} |
| 405 | ] |
| 406 | } |
| 407 | } |
| 408 | } |
| 409 | }, |
| 410 | "evidence": { |
| 411 | "socket": { |
| 412 | "type": "socket", |
| 413 | "table": { |
| 414 | "rows": 2, |
| 415 | "columns": [ |
| 416 | {"id": "link", "type": "link_ref", "role": "reference"}, |
| 417 | {"id": "src_actor", "type": "actor_ref", "role": "reference"}, |
| 418 | {"id": "dst_actor", "type": "actor_ref", "role": "reference"}, |
| 419 | {"id": "client_ip", "type": "ip_ref", "dictionary": "strings", "role": "group_key"}, |
| 420 | {"id": "client_port", "type": "uint", "role": "group_key"}, |
| 421 | {"id": "server_ip", "type": "ip_ref", "dictionary": "strings", "role": "group_key"}, |
| 422 | {"id": "server_port", "type": "uint", "role": "group_key"}, |
| 423 | {"id": "protocol", "type": "string_ref", "dictionary": "strings", "role": "group_key"}, |
| 424 | {"id": "state", "type": "string_ref", "dictionary": "strings"}, |
| 425 | {"id": "socket_count", "type": "uint", "role": "metric", "aggregation": "sum"} |
| 426 | ], |
| 427 | "values": [ |
| 428 | {"codec": "const", "value": 1}, |
| 429 | {"codec": "const", "value": 1}, |
| 430 | {"codec": "const", "value": 2}, |
| 431 | {"codec": "const", "value": 8}, |
| 432 | {"codec": "values", "values": [43000, 43001]}, |
| 433 | {"codec": "const", "value": 6}, |
| 434 | {"codec": "const", "value": 443}, |
| 435 | {"codec": "const", "value": 9}, |
| 436 | {"codec": "const", "value": 10}, |
| 437 | {"codec": "const", "value": 1} |
| 438 | ] |
| 439 | } |
| 440 | } |
| 441 | }, |
| 442 | "stats": { |
| 443 | "actors": 3, |
| 444 | "links": 2, |
| 445 | "evidence_rows": 2 |
| 446 | } |
| 447 | } |
| 448 | } |