AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter
Join our community

Actions277

Overview

This node operation, "Traffic Reports Total Domains Users," retrieves aggregated traffic report data focused on total domains and users. It is designed to query detailed network traffic statistics filtered by various parameters such as user agents, applications, categories, networks, organizations, and time ranges. This node is beneficial for network administrators or security analysts who want to analyze domain usage patterns, user activity, and potential threats within their network environment.

Practical examples include:

  • Generating reports on how many unique users accessed certain domains over a specified period.
  • Filtering traffic data by specific user agents or device types to understand usage trends.
  • Monitoring blocked versus allowed traffic to identify security incidents or policy enforcement effectiveness.
  • Grouping results by individual users to track user-specific network behavior.

Properties

Name Meaning
Additional Query Parameters A collection of optional filters and settings to customize the traffic report query:
- Agent Ids: Comma-separated list of user agent UUIDs (default all).
- Agent Types: Comma-separated list of user agent types.
- Application Ids: Comma-separated list of application IDs.
- Bucket Size: Desired bucket size for aggregation; options are auto, 15min, or 1day. Defaults to auto which adjusts based on date range.
- Category Ids: Comma-separated list of category IDs.
- Collection Ids: Comma-separated list of collection IDs.
- Domain: Filter domains starting with this value.
- From: UTC lower limit datetime for the report (format: YYYY-MM-DDThh:mm:ss or with Z). Defaults to current UTC minus 1 day.
- Mac Addresses: Comma-separated MAC addresses without colons.
- Network Ids: Comma-separated list of network IDs.
- Organization Ids: Comma-separated list of organization IDs. Defaults to user's organization.
- Private Ip: Private LAN IP filter.
- Private Ip From: Lower bound of private IP range.
- Private Ip To: Upper bound of private IP range.
- Security Report: Boolean to include threat reports (true), exclude (false), or both if empty.
- Show Individual Users: Boolean to group results by user ID.
- Source: Traffic source filter with options: all, networks, agents, proxies.
- To: UTC upper limit datetime for the report. Defaults to current UTC.
- Type: Type of report with options: all, allowed, blocked.
- User Ids: Comma-separated list of user IDs.

Output

The node outputs JSON data containing aggregated traffic report information about total domains and users according to the applied filters. The structure typically includes metrics grouped by domains and users, possibly segmented by time buckets depending on the bucket size parameter.

If binary data output is supported, it would represent raw report files or exports, but this is not indicated in the provided code or properties.

Dependencies

  • Requires an API key credential for authenticating requests to the AvantGuard DNSFilter service.
  • The node sends HTTP requests to the DNSFilter API endpoint at https://api.dnsfilter.com.
  • Proper configuration of the API authentication credential in n8n is necessary.
  • Network connectivity to the external DNSFilter API service is required.

Troubleshooting

  • Invalid Date Format Errors: If the from or to date parameters are not in the correct ISO 8601 format, the API may reject the request or default to fallback dates. Ensure dates follow YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ.
  • Empty or No Data Returned: This can occur if filters are too restrictive or no traffic matches the criteria. Try broadening filters like date range or removing some IDs.
  • Authentication Failures: Verify that the API key credential is correctly configured and has sufficient permissions.
  • API Rate Limits or Timeouts: Large queries with wide date ranges or many filters might hit rate limits or timeout. Use smaller date ranges or fewer filters.
  • Incorrect Parameter Names: All additional query parameters must be spelled exactly as expected (e.g., agent_ids, bucket_size) to be included properly in the API request.

Links and References

Discussion