Activity search

The Activity Search panel provides the most robust summary of what sites and applications are being accessed through Umbrella, the identities making each request, and whether a request was blocked or allowed.

Filtering options are primarily on the left sidebar of the page. If looking for traffic going to a specific domain, use the search bar at the top of the panel.

The filtering sidebar

• Response: whether a request was allowed, blocked, or proxied.
• Protocol: whether a request was using HTTP or HTTPS.
• Event Type: whether a request hit an application list or a destination list.
• Identity type: the type of device, network, or user which made a request. Typically only networks will appear.
• Security Categories: the specific security category a request hits.
• Content Categories: the specific content category a request hits.
• Search Options: enable this checkbox if it is desired to look at high-traffic domains such as content delivery networks.

The filtering search bar advanced options

• Identities: filter results by a specific identity by name, rather than by the identity's type.
• Domain: filter results by the specific domain being accessed
• URL: filter results by the specific URL being accessed - this is similar to filtering by domain, but offers more granular results if desired.
• IP: filter results by the IP address of the requester.
• Application: filter results by the application making a request.