External Queries
- Last Updated: April 5, 2026
- 3 minute read
- Flowmon Products
- Flowmon Anomaly Detection System
- Documentation
This part of the configuration can be found in Settings → System Settings → External queries.
You can use any available web services to get additional information about IP addresses, MAC addresses, domain names, and paths that are part of the URL. The queries can be invoked using the context menu of a particular object (IP address, MAC address, and so on) by clicking the External queries choice. When the querying is finished, a new browser tab opens. It is possible to use the following placeholders to define External queries:
Placeholders $IP, $IP4, $IP6 and $IP6HOST
All these placeholders represent an IP address. You can find the context menu for a particular IP address, for example, in the section Events → Simple list, in the Source column. It is possible to use a general $IP placeholder for both IPv4 and IPv6 addresses or to specify whether the definition of an External query should be applied only on IPv4 or IPv6 addresses using the $IP4 or $IP6 placeholders. Because the IPv6 addresses in the address bar of browsers must be entered in square brackets (when using an IPv6 address as an address of a server), it is possible to use the $IP6HOST placeholder.
The usage of placeholders example:
https://$IP4/path/to/file→ When using this definition for the IPv4 address 192.168.1.1, the result will be:https://192.168.1.1/path/to/file
https://www.mysearchengine.com/search?q=$IP6→ When using this definition for the IPv6 address ff02::1, the result will be:https://www.mysearchengine.com/search?q=ff02::1
https://$IP6HOST→ When using this definition for the IPv6 address fe80::1:1:1:1, the result will be:https://[fe80::1:1:1:1]
Placeholder $MAC
This placeholder is used for MAC addresses. You can open the context menu for a particular MAC address, for example, in the Event detail section.
The usage of placeholder example:
https://www.mysearchengine.com/search?q=$MAC→ When using this definition for the MAC address ff:ff:ff:ff:ff:ff, the result will be:https://www.mysearchengine.com/search?q=ff:ff:ff:ff:ff:ff
Placeholder $URL
This placeholder is used for paths that follow the domain name in the URL. You can find the context menu for a particular path, for example, in the Event evidence, as one of the items in flows.
To clarify the usage of this placeholder, see the following example:
The usage of placeholder example:
https://www.mydomain.com$URL→ When using this definition for the path /generate_204, the result will be:https://www.mydomain.com/generate_204
Placeholder $HOSTNAME
This placeholder is used for a domain name. You can find the context menu for a particular domain name, for example, in the Event evidence, as one of the items in flows.
The usage of placeholder example:
https://$HOSTNAME→ When using this definition for the hostname pool.ntp.org, the result will be:https://pool.ntp.org
Placeholder $ANY
The keyword $ANY can be used as a placeholder for all the objects mentioned above (IP addresses, MAC addresses, domain names, and paths in the URL). When using this placeholder in the definition of an External query, it is possible to use the External query with all of the mentioned objects.