Top Identities Report

The Top Identities report lists your organization's most active identities, based on DNS, Proxy, and IP requests, over the selected time period.

👍

Not all features described here are available to all Umbrella packages. For more information, see Determine Your Current Package. If you encounter a feature described here that you do not have access to, contact your sales representative for more information. See also, Cisco Umbrella Packages.

Table of Contents

• Prerequisites
• View the Top Identities Report
• View Identity in Other Reports

Prerequisites

• A minimum of Read Only access to the Umbrella dashboard. See Manage User Roles.

View the Top Identities Report

1. Navigate to Reporting > Additional Reports > Top Identities.

Report Fields

• Identity—The identity. Clicking an individual identity will bring you to the Identity Details for that identity.
• Requests—The number of requests the identity sent for the selected time period.

2. Select a time frame to view the Top Identities report.
   The report can be filtered by the last 24 hours, the previous calendar day (yesterday), the last 7 days, the last 30 days, or a custom range within the last 30 days.

3. Filter by traffic type. Choose either All (default), DNS only, Web only, or IP-Layer Enforcement only.

4. Filter by response type. Select Allowed or Blocked. By default, nothing is selected, so all responses are shown.

5. Filter by identities that were warned or accessed a destination after a warn.

6. Choose the identity types to show. By default, none are selected, so all are shown.

You can also search for an identity by name, domain, or URL.

7. Filter by security categories. By default, none are selected, so all are shown. For more information about security categories, see DNS Security Categories and Web Security Categories.

8. Filter by content categories. By default, none are selected, so all are shown. For a complete list of content categories, see DNS Content Categories and Web Content Categories.

View Identity in Other Reports

Each line in the report includes a menu displayed as three dots. Click this menu to reveal options for the selected identity:

• View Security Activity—Redirects you to the Security Activity Report.
• View in Activity Search—Redirects you to the Activity Search Report.
• View in Activity Volume—Redirects you to the Activity Volume Report.

---

Category Details < Top Identities Report > Identity Details