Top Destinations Report

The Top Destinations report is a list of the top domains visited by DNS for your Umbrella organization over the selected period. It is filterable, schedulable, and you can export the results to a CSV file.

Prerequisites

• A minimum of Read Only access to the Umbrella dashboard. See Manage User Roles.

View the Top Destinations Report

1. Navigate to Reporting > Additional Reports > Top Destinations.
   The report displays a chart of most visited destinations with filters to the left.

Report Fields

• Destination—The domain.
• Category—The category, such as Malware, Business Services, Phishing, and so on. To see a full list of categories, see Manage Security Settings, Manage Content Categories, and Application Categories.
• Allowed—The number of requests to that destination that were allowed.
• Blocked—The number of requests to that destination that were blocked.
• Requests—The number of requests for the domain for the selected period.

2. Choose a time frame to view the Destination Report.
   The Destination Report can be filtered by the Last 24 Hours, Yesterday, Last 7 Days, Last 30 Days, or a custom range within the last 30 days.

3. Filter results by the response type.
   Select Allowed, Blocked, Proxied, or Blocked: Destination List. By default, nothing is selected, so all responses are shown.

4. Filter by specific identity types and click Apply.

Alternatively, if you are looking for a specific identity to filter your results, enter it in the search bar. You can also filter by a specific domain.

5. Filter by specific security categories and click Apply.
   For more information about security categories, see Security Categories.

6. Filter by specific content categories and click Apply.
   For a full list of content categories, see Manage Content Categories.

Alternatively, checking Show Uncategorized will deselect all security and content categories and only display requests not matching any category.

8. Choose to optionally filter results by search options.

• Include All Traffic—Includes data from all domains including noisy domains that are filtered out by default.
• Combine Subdomains—Combines all subdomain requests from a parent domain and lists the combined requests under the parent domain.

Once you have chosen applicable filters, the report updates to reflect the data narrowed by those filters.

View Further Details

Clicking on any destination in the report table will redirect you to the Destination Details for that domain.

Activity Volume Report < Top Destinations Report > Destination Details