AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter
Join our community

Actions277

Overview

This node operation, "Traffic Reports Total Domains Organizations," retrieves aggregated traffic report data focused on total domains grouped by organizations. It is designed to query detailed network traffic statistics filtered by various criteria such as agents, applications, categories, networks, and time ranges. This node is useful for network administrators or security analysts who want to analyze domain traffic patterns across different organizations, identify blocked or allowed traffic, and generate threat reports.

Practical examples include:

  • Generating a report of all domains accessed by specific user agents within the last week.
  • Filtering traffic data to show only blocked domains for certain organizations.
  • Analyzing traffic sources by network or proxy over a custom date range.
  • Creating security reports highlighting threats detected in domain traffic.

Properties

Name Meaning
Additional Query Parameters Optional filters and parameters to customize the traffic report query. Includes:
- Agent Ids Comma separated list of user agent UUIDs; defaults to all.
- Agent Types Comma separated list of user agent types; defaults to all.
- Application Ids Comma separated list of application IDs; defaults to all.
- Bucket Size Desired bucket size for aggregation: auto, 15min, or 1day. Defaults to auto which selects 15 minutes if the date range is less than 24 hours, otherwise 1 day.
- Category Ids Comma separated list of category IDs; defaults to all.
- Collection Ids Comma separated list of collection IDs; defaults to all.
- Domain Filter to only search for domains starting with this value.
- From Report UTC lower limit datetime (format: YYYY-MM-DDThh:mm:ss or with Z). Defaults to current UTC minus 1 day or if format unrecognized.
- Mac Addresses Comma separated list of MAC addresses (without colons) or filter values; defaults to all.
- Network Ids Comma separated list of network IDs; defaults to all.
- Organization Ids Comma separated list of organization IDs; defaults to the user's organization ID.
- Private Ip Filter by private LAN IP.
- Private Ip From Lower limit of private LAN IP range.
- Private Ip To Upper limit of private LAN IP range.
- Security Report Boolean to indicate if the report should include threats (true), exclude threats (false), or both if not specified. Defaults to true.
- Show Individual Organizations Boolean to group report results by organization ID. Defaults to true.
- Source Traffic source filter with options: all, networks, agents, proxies. Defaults to all.
- To Report UTC upper limit datetime (format: YYYY-MM-DDThh:mm:ss or with Z). Defaults to current UTC or if format unrecognized.
- Type Type of report filter with options: all, allowed, blocked. Defaults to all.
- User Ids Comma separated list of user IDs; defaults to all.

Output

The node outputs JSON data containing aggregated traffic report information about total domains grouped by organizations. The structure typically includes fields representing domain counts, organization identifiers, timestamps (bucketed according to the selected bucket size), and possibly threat indicators depending on the security report setting.

If binary data output is supported, it would represent downloadable report files or raw data exports, but based on the provided code and properties, the primary output is structured JSON data summarizing traffic metrics.

Dependencies

  • Requires an API key credential for authenticating requests to the AvantGuard DNSFilter service.
  • The node sends HTTP requests to the DNSFilter API endpoint https://api.dnsfilter.com.
  • Proper configuration of the API authentication token in n8n credentials is necessary.
  • The node depends on the external @avantguardllc/n8n-openapi-node package for building request properties from the OpenAPI specification.

Troubleshooting

  • Invalid Date Format: If the from or to date parameters are not in the correct ISO 8601 format, the API may default to unexpected date ranges or return errors. Ensure dates follow YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ.
  • Empty or Incorrect Filters: Providing invalid IDs or malformed comma-separated lists in filters like agent_ids, network_ids, or organization_ids may result in no data returned or API errors.
  • Authentication Errors: Missing or incorrect API key credentials will cause authorization failures. Verify that the API key is correctly configured in n8n.
  • Network Issues: Connectivity problems to the DNSFilter API endpoint can cause request timeouts or failures.
  • Unsupported Bucket Size: Using unsupported values for bucket_size may lead to defaulting behavior or errors. Use only auto, 15min, or 1day.

Links and References

Discussion