Top Destinations Report

The Top Destinations report is a list of the top domains visited by DNS and firewall requests for your Umbrella organization over the selected period. It is filterable, schedulable, and you can export the results to a CSV file.

👍

Not all features described here are available to all Umbrella packages. For more information, see Determine Your Current Package. If you encounter a feature described here that you do not have access to, contact your sales representative for more information. See also, Cisco Umbrella Packages.

Prerequisites

• A minimum of Read Only access to the Umbrella dashboard. See Manage User Roles.

View the Top Destinations Report

1. Navigate to Reporting > Additional Reports > Top Destinations.
   The report displays a chart of most visited destinations with filters to the left.

Report Fields

• Destination—The domain.
• Category—The category, such as Malware, Business Services, Phishing, and so on. For a list of categories, see DNS Security Categories, Web Security Categories, DNS Content Categories, Web Content Categories, and Application Categories.
• Allowed—The number of requests to that destination that were allowed.
• Blocked—The number of requests to that destination that were blocked.
• Requests—The number of requests for the domain for the selected period.

2. Choose a time frame to view the Destination Report.
   The Destination Report can be filtered by the last 24 hours, the previous calendar day (yesterday), the last 7 days, last 30 days, or a custom range within the last 30 days.

3. Choose whether to view results for all types of traffic, DNS only, Web only, or Firewall (if applicable) only.
   By default, All is selected.

4. Filter results by the response type.
   Select Allowed, Blocked, Allowed: Destination List, or Blocked: Destination List. By default, nothing is selected, so all responses are shown.

5. Filter results by requests that were warned or accessed after a warning.

6. Filter by specific identity types and click Apply.

Alternatively, if you are looking for a specific identity to filter your results, enter it in the search bar. You can also filter by a specific domain.

7. Filter by specific security categories and click Apply.
   For more information about security categories, see DNS Security Categories and Web Security Categories.

8. Filter by specific content categories and click Apply.
   For a full list of content categories, see DNS Content Categories and Web Content Categories.

Alternatively, checking Show Uncategorized will deselect all security and content categories and only display requests not matching any category.

9. Choose to optionally filter results by search options.

• Include All Traffic—Includes data from all domains including noisy domains that are filtered out by default.
• Combine Subdomains—Combines all subdomain requests from a parent domain and lists the combined requests under the parent domain.

Once you have chosen applicable filters, the report updates to reflect the data narrowed by those filters.

View Further Details

Clicking on any destination in the report table will redirect you to the Destination Details for that domain.

---

Activity Volume Report < Top Destinations Report > Destination Details