The Top Identities Report is a list of the top identities with the most activity by DNS requests for your Umbrella organization over the selected period. It is filterable, schedulable, and you can export the results to a CSV file.

Understand the Top Identities Report

Search for an Identity

You can search for an identity by either searching for the name, domain or URL:

To view the Identity Details of an individual identity, click the name.

Report Fields

• Identity—The identity.
• Requests—The number of requests the identity sent for the selected period.

View Menu

Each line in the report has a menu to the right side (shown as three dots: "..."). Clicking on this menu reveals three options:

• View Security Activity—Redirects you to the Security Activity for that identity.
• View in Activity Search—Redirects you to the Activity Search Report filtered by that identity.
• View in Activity Volume—Redirects you to the Activity Volume Report filtered by this identity.

Filters

• Response—Select Allowed, or Blocked. By default, nothing is selected, so all responses are shown.

• Identity Type—Select the identity types to show. By default, none are selected, so all are shown.

• Security Categories—Select the security categories to show. By default, none are selected, so all are shown.

• Content Categories—Select the content categories to show. By default, none are selected, so all are shown.

Category Details < Top Identities Report > Identity Details