Destination Details

The Destination Details Report provides access to information about the destinations that your identities are visiting, determining which are the most actively requested and when this activity occurs. Here you can explore activity at the domain level, determining who has visited the selected domain and when. This detailed information can help you determine if any computer or networks are compromised or are connecting to known malicious sites so that you can better protect yourself and others.

Table of Contents

• Prerequisites
• View the Destination Details
• View the Request Traffic
• View the Access & Policy Details
• View Recent Activity
• View the Most Visited URL Paths

Prerequisites

• A minimum of Read Only access to the Umbrella dashboard. See Manage User Roles.

View the Destination Details

1. Navigate to Reporting > Additional Reports > Top Destinations and click a domain to explore.

You can also search for a destination in the Top Destinations Report. When you search for a destination, Umbrella returns any related domains and subdomains.

2. Choose a time frame to view the Destination Details.
   Like other Umbrella reports, the Destination Details can be filtered by time: the last 24 hours, the previous calendar day (yesterday), the last seven days, the last month, or a custom range within the last 30 days.

3. View the destination's content and security categories.
   At the top of the report, under the domain for the destination you are viewing, are any categories associated with the destination. For category definitions, see Content Category Definitions and Security Categories.

If you believe this destination belongs in a security category, click Suggest Security Categorization and fill out the request which creates an internal Umbrella ticket for a security researcher to review. Then, click Send.

View the Request Traffic

The traffic graph displays the traffic for the type selected (blocked, allowed, or both) within the selected time period. This enables you to visualize when there are more active requests for this destination and if these requests are allowed or blocked.

View Requests by Blocked or Allowed

1. Click on Allowed, Blocked, or both to view those requests in the traffic graph.
   The graph displays the number of blocked and allowed requests for the destination you are viewing within the selected time period. You can choose to see both Allowed and Blocked requests, or one or the other individually. By default, only Allowed are shown initially.

2. Hover on a point on the graph to reveal the date and time and the number of Blocked and/or Allowed requests at that point.
   Clicking the point will redirect you to the Activity Search Report filtered by this domain and the Response (Blocked or Allowed) selected.

View Requests Through Global Traffic %

1. Click Global Traffic % on the traffic graph.
   The Global Traffic % chart displays the percentage of global traffic to this specific destination that is comprised of local traffic from your organization’s Identities.

2. Hover on a point to view the date, time, and percentage of global traffic at that time.

View Details in Investigate

Click View <destination> in Investigate to open the destination in Investigate and view further details about the destination you are investigating.

View the Access & Policy Details

The Access and Policy Details presents information related to identities accessing the destination and if the destination belongs to any Destination List policies.

1. Navigate to the Access & Policy Details > Top Identities.
   The Top Identities list shows the identities that had the most requests for access to this destination. Clicking View All Identities will bring you to the Top Identities Report filtered by this destination.

2. Navigate to the Access & Policy Details > Destination Lists.
   The Destination Lists table shows if this domain belongs to any Destination Lists in your policies and what effect that list would have on the domain. Clicking View All Policies will bring you to the Destination Lists component of policies.

View Recent Activity

The Recent Activity chart lets you investigate DNS activity for this destination. You can view the identities that requested the destination, the response to that request (Blocked or Allowed), the External and Internal IP addresses, and the date and time of the request. Viewing this information enables you to make decisions about how to best maintain your destination lists. Clicking View All Activity will bring you to the Activity Search Report filtered by this domain.

View the Most Visited URL Paths

This chart lists the most frequently visited URL paths for this domain and the number of requests for each path within the requested time period.

---

Top Destinations Report < Destination Details > Top Categories Report