AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter

Actions277

Overview

The "Traffic Reports Top Domains" operation in the Traffic Reports resource fetches aggregated data about the top domains seen in network traffic reports. This node is useful for analyzing domain usage patterns, identifying frequently accessed domains, and monitoring network security by filtering traffic based on various criteria such as user agents, applications, categories, and time ranges.

Typical use cases include:

  • Network administrators wanting to identify the most visited domains within a specified timeframe.
  • Security teams filtering traffic reports to detect suspicious or blocked domains.
  • MSPs or organizations analyzing traffic sources and types to optimize network policies.

Properties

Name Meaning
Additional Query Parameters Optional filters and parameters to refine the traffic report query. These include:
- Agent Ids: Comma-separated list of user agent UUIDs (default all)
- Agent Types: Comma-separated list of user agent types (default all)
- Application Ids: Comma-separated list of application IDs (default all)
- Category Ids: Comma-separated list of category IDs (default all)
- Collection Ids: Comma-separated list of collection IDs (default all)
- Domain: Filter domains starting with this value
- Fqdn: Filter fully qualified domain names containing this value
- From: UTC lower limit datetime for report (format YYYY-MM-DDThh:mm:ss or with Z)
- Mac Addresses: Comma-separated MAC addresses without colons (default all)
- Msp Id: Managed Service Provider ID (number)
- Network Ids: Comma-separated list of network IDs (default all)
- Organization Ids: Comma-separated list of organization IDs (default to user org)
- Page: JSON object specifying page number and size (defaults page 1, size 10 max 100)
- Private Ip: Private LAN IP filter
- Private Ip From/To: Range for private LAN IPs
- Security Report: Filter by threat report status ("all", "true", "false")
- Source: Traffic source filter ("all", "networks", "agents", "proxies")
- To: UTC upper limit datetime for report
- Type: Report type filter ("all", "allowed", "blocked")
- User Ids: Comma-separated local user IDs (default all)

Output

The node outputs JSON data representing the top domains from the traffic reports matching the specified filters. The structure typically includes domain names along with associated metrics such as counts or scores indicating their prominence or frequency in the traffic data.

If binary data output is supported, it would represent raw report files or attachments related to the traffic data, but this node primarily outputs structured JSON.

Dependencies

  • Requires an API key credential for authenticating with the AvantGuard DNSFilter service.
  • The node sends HTTP requests to the DNSFilter API endpoint https://api.dnsfilter.com.
  • Proper configuration of credentials in n8n is necessary to authorize API calls.

Troubleshooting

  • Invalid Date Format: If the from or to date parameters are not in the correct ISO format (YYYY-MM-DDThh:mm:ss or with trailing Z), the API may return errors or default to fallback dates. Ensure date strings are correctly formatted.
  • Empty Results: Applying overly restrictive filters (e.g., specific agent IDs or narrow date ranges) might result in no data returned. Try broadening filters.
  • Authentication Errors: Missing or invalid API credentials will cause authentication failures. Verify that the API key credential is correctly set up.
  • Pagination Issues: If requesting pages beyond available data, results may be empty. Adjust the page parameter accordingly.
  • Parameter Conflicts: Some filters might conflict or be unsupported together; consult API documentation if unexpected errors occur.

Links and References

Discussion