Top Identities Report
The Top Identities report lists your organization's most active identities, based on DNS, Proxy, and IP requests, over the selected time period.
![update 1:22.png 1283](https://files.readme.io/d35bc1c-update_122.png)
Not all features described here are available to all Umbrella packages. For more information, see Determine Your Current Package. If you encounter a feature described here that you do not have access to, contact your sales representative for more information. See also, Cisco Umbrella Packages.
Table of Contents
Prerequisites
- A minimum of Read Only access to the Umbrella dashboard. See Manage User Roles.
View the Top Identities Report
- Navigate to Reporting > Additional Reports > Top Identities.
Report Fields
- Identity—The identity. Clicking an individual identity will bring you to the Identity Details for that identity.
- Requests—The number of requests the identity sent for the selected time period.
- Select a time frame to view the Top Identities report.
The report can be filtered by the last 24 hours, the previous calendar day (yesterday), the last 7 days, the last 30 days, or a custom range within the last 30 days.
![time .png 125](https://files.readme.io/d9faea5-time_.png)
- Filter by traffic type. Choose either All (default), DNS only, Web only, or IP-Layer Enforcement only.
![updated traffic type.png 241](https://files.readme.io/c2b6f56-updated_traffic_type.png)
- Filter by response type. Select Allowed or Blocked. By default, nothing is selected, so all responses are shown.
![sec act response.png 266](https://files.readme.io/4d01055-sec_act_response.png)
- Filter by identities that were warned or accessed a destination after a warn.
![warn filter.png 220](https://files.readme.io/f4bb19d-warn_filter.png)
- Choose the identity types to show. By default, none are selected, so all are shown.
![updated identity typw.png 236](https://files.readme.io/854fed3-updated_identity_typw.png)
You can also search for an identity by name, domain, or URL.
![top identities search.png 443](https://files.readme.io/5c764c4-top_identities_search.png)
- Filter by security categories. By default, none are selected, so all are shown. For more information about security categories, see DNS Security Categories and Web Security Categories.
![updated security categories.png 223](https://files.readme.io/1b03f6e-updated_security_categories.png)
- Filter by content categories. By default, none are selected, so all are shown. For a complete list of content categories, see DNS Content Categories and Web Content Categories.
![updated content categories .png 225](https://files.readme.io/41f767b-updated_content_categories_.png)
View Identity in Other Reports
Each line in the report includes a menu displayed as three dots. Click this menu to reveal options for the selected identity:
- View Security Activity—Redirects you to the Security Activity Report.
- View in Activity Search—Redirects you to the Activity Search Report.
- View in Activity Volume—Redirects you to the Activity Volume Report.
![identity view menu.png 857](https://files.readme.io/77e4e62-identity_view_menu.png)
Category Details < Top Identities Report > Identity Details
Updated 8 months ago