The following sections are included:

Umbrella Reporting Basics

Use the reporting features of Cisco Umbrella to gain a better understanding of your Umbrella usage. You can gain insights into request activity and blocked activity, determining which Identities are generating requests that are being blocked. Reports help build actionable intelligence in addressing security threats including changes in trend over time and more.

Reporting Overview

The primary reports in Umbrella are:

  • Activity Search—Activity from the identities in your environment over a selected time period. Filterable by identity name, destination, source IP, response, content category, and security category
  • Security Activity—Security-related activity in your environment, including malware, phishing, and all other security categories over the selected time period. Filterable by identity, destination, source IP, and security category
  • Cloud Services—Overview of cloud services accessed by your organization over the selected time period. Filterable by Cloud Service Name, Identity, and Classification
  • Destinations Report—A report showing the most active destinations within your dashboard for all identities, and that allows you to go further and find out how the traffic for this destination from your Identities compares to the traffic from all of the Umbrella global network
  • Identities Report—A report showing your identities in the order of which is most active, then allowing you to drill down to find out more about that specific identity and what destinations they have visited, whether those destinations are malicious or not, and a trend of their overall traffic
  • Total Requests—Total requests for destinations from your organization over the selected time period. Filterable by Identity
  • Activity Volume—Total queries within your organization broken down by security categories and results over the selected time period. Filterable by Identity. This report has two views: Snapshot (table) and Trend Over Time (graph)
  • Top Domains—A list of the most requested domains within your organization over the selected time period. Filterable by Identity, response, destination, content category, and security category
  • Top Categories—A list of the top content categories for your organization over the selected time period. Filterable by Identity and response
  • Top Identities—A list of the top traffic-generating Identities over the selected time period. Filterable by Identity and destination
  • Admin Audit Log—A record of any configuration changes made to your settings by any of the administrators of your dashboard


Exporting, Sharing, Bookmarking and Scheduling Reports


The share reports feature can be found under Reports by clicking the Share Reports icon