The Umbrella Documentation Hub

Welcome to the Umbrella documentation hub. Here you'll find our comprehensive guides designed to help you use with Cisco Umbrella.

Get Started    

Top Categories Report

The Top Categories report is a list of the top security and content categories by DNS and/or firewall requests for your Umbrella organization over the selected period. It is filterable, schedulable, and you can export the results to a CSV file.

Understand the Top Categories Report

Quick View

To display a quick view of a category's data, click on the number of requests next to the traffic type. The display will show the most active identities and their respective requests, as well as a trend graph based on the time selection in the report.

Report Fields

  • Category—The category, such as Malware, Business Services, Phishing, and so on.
    To see a full list of categories, see Manage Security Settings, Manage Content Categories, and Manage Application Categories.
  • Type—The type of category: security, content, or application.
  • Activity—The number of requests for the category for the selected period. Clicking on the number of requests reveals more information: the total requests for the selected period, which of the requests were blocked and which were allowed, and the most active identities (the identities that have requested the category the most).

View Menu

Each line in the report has a menu to the right side (shown as three dots: "..."). Clicking on this menu reveals three options:

Filters

  • Time—Select the time frame you wish to view the report in: Last 24 Hours, Last 7 Days, Last 30 Days, or a Custom range.
  • Category Type—Select either All, Security or Content. By default, All is selected, so both security and content categories are shown.
  • Traffic Type—Select either All, DNS, or Proxy. By default, All is selected, so both DNS and proxy traffic is shown.
  • Response—Select Allowed and/or Blocked. By default, neither is selected, so all responses are shown.
  • Identity Type—Select one or more identity types, such as Networks, Roaming Computers, Sites, and so on. By default, no identity types are selected, so all identity types are shown. Once identities are selected, click Apply.

You also have the option to search by identity if you know the identity name:

Sorting

  • DNS Requests—Show DNS requests first.
  • Proxy Requests—Show proxy requests first.
  • Proxy Traffic—Show proxy traffic first.
  • Descending—Show the results in descending order. By default, descending is selected.
  • Ascending—Show the results in ascending order.

Use the Top Categories Report

  1. Navigate to Reporting > Additional Reports > Top Categories.
    This takes you to the top-level of the Top Categories report page, which lists categories by requests made within the selected period. The default period is 24 hours. You can schedule a Top Categories report, or export the current Top Categories report to a CSV. For more information, see Schedule a Report and Export Report Data to CSV.
  1. To refine the results, you can select filters or sort the report by request type or order. See Understand the Top Categories Report for more information.
  2. In the Top Categories table, under the Category field, click a category to view its Category Details. See Category Details for more information.

Destinations Details < Top Categories Report > Category Details

Updated 6 days ago

Top Categories Report


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.