AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter
Join our community

Actions277

Overview

This node operation, Traffic Reports Top Agents, retrieves detailed traffic report data focused on the top user agents within a network or organization. It is designed to query and filter traffic analytics based on various agent-related parameters such as agent IDs, types, associated applications, networks, and time ranges.

Typical use cases include:

  • Network administrators analyzing which user agents generate the most traffic.
  • Security teams monitoring allowed vs blocked traffic by specific agents.
  • MSPs or organizations wanting granular insights into traffic sources filtered by agent attributes.

For example, you could use this node to fetch the top agents that generated blocked traffic in the last 24 hours across certain networks or to analyze traffic patterns for specific application IDs.

Properties

Name Meaning
Additional Query Parameters A collection of optional filters and pagination controls to refine the traffic report query. These include:
- Agent Ids Comma separated list of user agent UUIDs to filter by; defaults to all agents if empty.
- Agent Types Comma separated list of user agent types to filter by; defaults to all types.
- Application Ids Comma separated list of application IDs to filter by; defaults to all applications.
- Collection Ids Comma separated list of collection IDs to filter by; defaults to all collections.
- From UTC datetime string (format YYYY-MM-DDThh:mm:ss or with Z) specifying the lower bound of the report time range; defaults to current UTC minus 1 day if not provided or invalid.
- Mac Addresses Comma separated list of MAC addresses (without colons) or filter values; defaults to all.
- Msp Id Numeric MSP ID to filter reports by managed service provider; default is 0.
- Name Filter agents whose name contains this substring.
- Nat Ips Comma separated list of NAT IPs (valid integers from 101 to 106); defaults to all.
- Network Ids Comma separated list of network IDs to filter by; defaults to all.
- Organization Ids Comma separated list of organization IDs to filter by; defaults to the user's organization ID.
- Page JSON object controlling pagination, including page number (default 1) and size (default 10, max 100).
- Private Ip Filter by private LAN IP address.
- Private Ip From Lower limit of private LAN IP range filter.
- Private Ip To Upper limit of private LAN IP range filter.
- Security Report Boolean flag to filter for threat reports only (true), non-threats only (false), or both if unset. Defaults to true.
- Source Traffic source filter; options are "all" (default), "networks", "agents", or "proxies".
- To UTC datetime string specifying the upper bound of the report time range; defaults to current UTC datetime if not provided or invalid.
- Type Type of report to retrieve; options are "all" (default), "allowed", or "blocked".
- User Ids Comma separated list of local user IDs to filter by; defaults to all users.

Output

The node outputs JSON data representing the traffic report results filtered by the specified parameters. The structure typically includes aggregated statistics and details about the top user agents matching the query criteria.

  • The json output field contains an array or object with traffic metrics, agent identifiers, counts of allowed/blocked requests, timestamps, and possibly threat indicators depending on the security_report flag.
  • No binary data output is indicated for this operation.

Dependencies

  • Requires an API key credential for authenticating with the AvantGuard DNSFilter service.
  • The node makes HTTP requests to the DNSFilter API endpoint at https://api.dnsfilter.com.
  • Proper configuration of credentials and network access to the API is necessary.

Troubleshooting

  • Invalid Date Format: If the from or to date strings are not in the expected ISO format, the API may default to preset times or return errors. Ensure dates follow YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ.
  • Pagination Limits: Requesting page sizes larger than 100 may be rejected or truncated by the API.
  • Empty Results: Using overly restrictive filters (e.g., very specific agent IDs or date ranges) might yield no data.
  • Authentication Errors: Missing or incorrect API key credentials will cause authorization failures.
  • Network Issues: Connectivity problems to the API endpoint can result in request timeouts or errors.

To resolve these issues:

  • Validate input formats carefully.
  • Check API key validity and permissions.
  • Adjust filters to broaden queries if needed.
  • Verify network connectivity and proxy settings.

Links and References

Discussion