The Umbrella Documentation Hub

Welcome to the Umbrella documentation hub. Here you'll find access to all of our Cisco Umbrella user guides.

Get Started    

Top Destinations Report

The Top Destinations report is a list of the top domains visited by DNS and/or firewall requests for your Umbrella organization over the selected period. It is filterable, schedulable, and you can export the results to a CSV file.

Understand the Top Destinations Report

Report Fields


  • Response—Select Allowed, Blocked, or Blocked: Destination List. By default, nothing is selected, so all responses are shown.
  • Security Categories—Select the security categories to show. By default, none are selected, so all are shown.
  • Content Categories—Select the content categories to show. By default, none are selected, so all are shown.

Search Options

  • Include All Traffic—Includes data from all domains including noisy domains that are filtered out by default.
  • Combine Subdomains—Combines all subdomain requests from a parent domain and lists the combined requests under the parent domain.

Use the Top Destinations Report

  1. Navigate to Reporting > Additional Reports > Top Destinations.
    This takes you to the top-level of the Top Destinations report page, which lists the most visited domains within the selected period. The default period is 24 hours. You can schedule a Top Destinations report, or export the current Top Destinations report to a CSV. For more information, see Schedule a Report and Export Report Data to CSV.
  1. To refine the results, you can select filters or sort the report by request type or order. See Understand the Top Destinations Report for more information.
  2. In the Most Visited Domains table, under the Domain field, click a domain to view its Destination Details. See Destination Details for more information.

Activity Search Report < Top Destinations Report > Destination Details

Updated 6 months ago

Top Destinations Report

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.