AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter
Join our community

Actions277

Overview

This node allows querying traffic report logs from the AvantGuard DNSFilter service. It is designed to retrieve detailed network traffic data filtered by various criteria such as user agents, applications, domains, IP addresses, and time ranges. This node is useful for network administrators and security analysts who want to monitor, analyze, or audit DNS traffic and related security events within their organization.

Typical use cases include:

  • Fetching logs of allowed or blocked DNS queries over a specific period.
  • Filtering traffic reports by user agents, networks, or proxies.
  • Generating security threat reports based on DNS query results.
  • Auditing domain access patterns or application usage in the network.

Properties

Name Meaning
Additional Query Parameters Optional parameters to refine the traffic report query. These include:
- Agent Id (single UUID)
- Agent Ids (comma-separated UUIDs)
- Application Category Ids
- Application Ids
- Category Ids
- Collection Id(s)
- Domain prefix filter
- FQDN substring filter
- From (UTC datetime lower limit)
- To (UTC datetime upper limit)
- MAC Addresses
- NAT IPs (integer list 101-106)
- Network Id(s)
- Organization Id (defaults to user org)
- Page (pagination object with page number and size)
- Private IP or IP range (from/to)
- Question Type (DNS query type)
- Result (all, allowed, blocked)
- Security Report (boolean to include threats)
- Source (networks, agents, proxies, or all)
- User Id(s)

The "Result" property has three options:

  • All
  • Allowed
  • Blocked

The "Source" property options are:

  • All
  • Networks
  • Agents
  • Proxies

Output

The node outputs JSON data representing the queried traffic report logs. The structure typically includes an array of log entries, each containing details about DNS queries such as timestamps, source identifiers, domain names, query types, results (allowed/blocked), and any associated security threat information.

No binary data output is indicated.

Dependencies

  • Requires an API key credential for authenticating with the AvantGuard DNSFilter API.
  • The node uses the base URL https://api.dnsfilter.com for requests.
  • Proper configuration of the API authentication credential in n8n is necessary.

Troubleshooting

  • Invalid Date Format: If the "From" or "To" date properties are not in the expected ISO 8601 format (YYYY-MM-DDThh:mm:ss or with trailing Z), the API may default to current UTC datetime minus one day or current datetime respectively, which might lead to unexpected results.
  • Pagination Limits: The page size defaults to 10 and has a maximum of 100. Requests exceeding this may be rejected or truncated.
  • Empty Results: If filters are too restrictive or incorrect (e.g., invalid agent IDs or domain filters), the query may return no data.
  • Authentication Errors: Ensure the API key credential is valid and has sufficient permissions.
  • API Rate Limits: Excessive querying may trigger rate limits; handle errors accordingly.

Links and References

Discussion