The Umbrella Documentation Hub

Welcome to the Umbrella documentation hub. Here you'll find our comprehensive guides designed to help you use with Cisco Umbrella.

Get Started    

Top Categories Report

The Top Categories report is a list of the top security and content categories by DNS and/or firewall requests for your Umbrella organization over the selected period. It is filterable, schedulable, and you can export the results to a CSV file.

Understand the Top Categories Report

Top Categories Report


  • Category Type—Select either All, Security or Content. By default, All is selected, so both security and content categories are shown.
  • Traffic Type—Select either All, DNS, or Proxy. By default, All is selected, so both DNS and proxy traffic is shown.
  • Response—Select Allowed and/or Blocked. By default, neither is selected, so all responses are shown.
  • Identity Type—Select one or more identity types, such as Networks, Roaming Computers, Sites, and so on. By default, no identity types are selected, so all identity types are shown.


  • DNS Requests—Show DNS requests first.
  • Proxy Requests—Show proxy requests first.
  • Proxy Traffic—Show proxy traffic first.
  • Descending—Show the results in descending order. By default, descending is selected.
  • Ascending—Show the results in ascending order.

Report Fields

  • Category—The category, such as Malware, Business Services, Phishing, and so on.
    To see a full list of categories, see Manage Security Settings, Manage Content Categories, and Manage Application Categories.
  • Type—The type of category: security, content, or application.
  • Activity—The number of requests for the category for the selected period. Clicking on the number of requests reveals more information: the total requests for the selected period, which of the requests were blocked and which were allowed, and the most active identities (the identities that have requested the category the most).

View Menu

Each line in the report has a menu to the right side (shown as three dots: "..."). Clicking on this menu reveals two options: View in Activity Search or View in Top Domains. This way, you can view results for a category and the selected period within the Activity Search or Top Domains reports for more granular information.

Category Details

Clicking on a category from the report takes you to the category details. This section provides more information on the category. You can see the amount of traffic to a category (for proxy transactions, this also includes bandwidth), the top identities that request a category the most, and the top domains requested that belong to the category.

Content/Security Category

The Content/Security Category card contains a line graph that includes two views: Activity Breakdown and Bandwidth.

  • Activity Breakdown—Shows the number of DNS requests, proxy transactions, and firewall sessions for the selected period. It can be filtered by traffic type. By default, All Activity is selected, so all three traffic types are shown.
  • Bandwidth—For proxy transactions, the bandwidth view of the line graph shows the number of inbound and outbound traffic for the selected period.

Identity Distribution

The Identity Distribution card contains a pie chart that illustrates the number of identity types that have made requests for the category in the selected period.

Top Identities

  • Identity—The name of the identity.
  • Requests—The number of requests the identity has made for the category for the selected period.

Top Domains

  • Domain Name—The domain name, such as
  • Other Categories—If there are other categories associated with the domain in addition to the current category being viewed, they are listed here.
  • Requests—The number of requests made for this domain for the selected period.

Use the Top Categories Report

  1. Navigate to Reporting > Additional Reports > Top Categories.
    This takes you to the top-level of the Top Categories report page, which lists categories by requests made within the selected period. The default period is 24 hours. You can schedule a Top Categories report, or export the current Top Categories report to a CSV. For more information, see Schedule a Report and Export Report Data to CSV.
  1. To refine the results, you can select filters or sort the report by request type or order. See Understand the Top Categories Report for more information.
  2. In the Top Categories table, under the Category field, click a category to view its Category Details. See Category Details for more information.

Top Domains Report < Top Categories Report > Top Identities Report

Top Categories Report

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.