AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter

Actions277

Overview

The "Traffic Reports Top Collections" operation within the "Traffic Reports" resource is designed to retrieve summarized traffic report data focused on top collections. This node allows users to query detailed network traffic analytics filtered by various parameters such as user agents, applications, networks, and time ranges. It is beneficial for network administrators or security analysts who want to monitor and analyze traffic patterns, detect threats, or generate reports on allowed or blocked traffic.

Practical examples include:

  • Generating a report of the top collections of traffic blocked by security policies within a specific date range.
  • Filtering traffic reports by specific user agents or MAC addresses to investigate suspicious activity.
  • Analyzing traffic sources from particular networks or organizations to optimize network performance or security.

Properties

Name Meaning
Additional Query Parameters Optional filters and parameters to customize the traffic report query. Includes:
- Agent Ids: Comma-separated list of user agent UUIDs (default all).
- Agent Types: Comma-separated list of user agent types (default all).
- Application Ids: Comma-separated list of application IDs (default all).
- Collection Ids: Comma-separated list of collection IDs (default all).
- From: UTC lower limit datetime for the report (format YYYY-MM-DDThh:mm:ss or with Z). Defaults to current UTC minus 1 day.
- Mac Addresses: Comma-separated list of MAC addresses without colons (default all).
- Msp Id: MSP ID number.
- Name: Filter local users whose name contains this value.
- Nat Ips: Comma-separated list of NAT IPs (valid integers 101 to 106).
- Network Ids: Comma-separated list of network IDs (default all).
- Organization Ids: Comma-separated list of organization IDs (default user org ID).
- Page: JSON object specifying page number (default 1) and size (default 10, max 100).
- Private Ip: Private LAN IP.
- Private Ip From: Lower limit of private LAN IP range.
- Private Ip To: Upper limit of private LAN IP range.
- Security Report: Boolean to filter threat reports (true/false). If empty, includes both threats and non-threats.
- Source: Traffic source filter with options: All, Networks, Agents, Proxies (default All).
- To: UTC upper limit datetime for the report (format YYYY-MM-DDThh:mm:ss or with Z). Defaults to current UTC.
- Type: Type of report with options: All, Allowed, Blocked (default All).
- User Ids: Comma-separated list of local user IDs (default all).

Output

The node outputs JSON data representing the top collections in the traffic reports based on the applied filters. The structure typically includes aggregated metrics and details about collections such as counts, identifiers, and possibly metadata related to traffic volume or security events.

If binary data output is supported, it would represent downloadable report files or attachments, but this is not indicated in the provided code or properties.

Dependencies

  • Requires an API key credential for authenticating requests to the external traffic reporting service.
  • The node uses a base URL endpoint (not explicitly shown here) to send HTTP requests with query parameters constructed from the input properties.
  • Proper configuration of the API authentication token or key in n8n credentials is necessary.

Troubleshooting

  • Common Issues:

    • Incorrect date/time format in "From" or "To" fields may cause the API to default to fallback dates or return errors.
    • Providing invalid or malformed comma-separated lists (e.g., agent IDs, MAC addresses) can lead to no results or API errors.
    • Exceeding maximum page size (over 100) might be rejected by the API.
    • Missing or invalid API authentication will result in authorization errors.
  • Error Messages:

    • Authorization errors indicating missing or invalid API keys require checking credential setup.
    • Validation errors related to query parameters suggest reviewing the formatting and allowed values.
    • Network or timeout errors indicate connectivity issues with the external API endpoint.

Links and References

  • Refer to the official API documentation of the traffic reporting service for detailed parameter descriptions and response formats.
  • n8n documentation on how to configure API key credentials and use HTTP request nodes for similar integrations.

Discussion