The Umbrella Documentation Hub

Welcome to the Umbrella documentation hub. Here you'll find our comprehensive guides designed to help you use Cisco Umbrella.

Get Started    

Top Identities Report

The Top Identities report is a list of the top identities with the most activity by DNS and/or firewall requests for your Umbrella organization over the selected period. It is filterable, schedulable, and you can export the results to a CSV file.

Understand the Top Identities Report

Search for an Identity

You can search for an identity by either searching for the name, domain or URL:

Clicking on an individual identity will bring you to the identity deatils for that identity.

Report Fields

  • Identity—The identity.
  • Requests—The number of requests the identity sent for the selected period.

View Menu

Each line in the report has a menu to the right side (shown as three dots: "..."). Clicking on this menu reveals three options:


  • Traffic Type—Select either All, DNS or Proxy. By default, All is selected, so both DNS and Proxy are shown.
  • Response—Select Allowed, or Blocked. By default, nothing is selected, so all responses are shown.
  • Identity Type—Select the identity types to show. By default, none are selected, so all are shown.
  • Security Categories—Select the security categories to show. By default, none are selected, so all are shown.

Category Details < Top Identities Report > Identity Details

Updated about a month ago

Top Identities Report

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.