AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter

Actions277

Overview

This node operation, Traffic Reports Total Requests Users, retrieves aggregated traffic report data focused on total requests made by users. It is designed to provide detailed insights into user traffic patterns over a specified time range, with options to filter and group the data by various criteria such as user agents, networks, applications, and more.

Typical use cases include:

  • Monitoring network usage by individual users or groups.
  • Analyzing allowed versus blocked traffic requests.
  • Generating security reports highlighting threat-related traffic.
  • Customizing reports based on specific agents, networks, or organizational units.

For example, a network administrator could use this node to generate a daily report showing how many requests each user made, filtered by certain application IDs and grouped by user ID, helping identify unusual activity or usage trends.

Properties

Name Meaning
Additional Query Parameters Optional filters and parameters to customize the report output. Includes:
- Agent Ids: Comma separated list of user agent UUIDs (default all)
- Agent Types: Comma separated list of user agent types (default all)
- Application Ids: Comma separated list of application IDs (default all)
- Bucket Size: Desired bucket size for aggregation; possible values: auto, 15min, 1day (default auto)
- Collection Ids: Comma separated list of collection IDs (default all)
- From: Report start datetime in UTC (format YYYY-MM-DDThh:mm:ss or with Z) (default current UTC minus 1 day)
- Mac Addresses: Comma separated list of MAC addresses without colons (default all)
- MSP Id: Managed Service Provider ID (default 0)
- Nat Ips: Comma separated list of NAT IPs (valid integers 101 to 106) (default all)
- Network Ids: Comma separated list of network IDs (default all)
- Organization Ids: Comma separated list of organization IDs (default user org ID)
- Private Ip: Specific private LAN IP
- Private Ip From/To: Range for private LAN IPs
- Security Report: Boolean to include threats only (true), non-threats only (false), or both if empty (default true)
- Show Individual Users: Boolean to group results by user ID (default true)
- Source: Traffic source filter; options are all, networks, agents, proxies (default all)
- To: Report end datetime in UTC (format YYYY-MM-DDThh:mm:ss or with Z) (default current UTC)
- Type: Type of report; options are all, allowed, blocked (default all)
- User Ids: Comma separated list of local user IDs (default all)

Output

The node outputs JSON data representing the aggregated traffic report according to the specified filters and grouping. The structure typically includes:

  • Aggregated counts of total requests per user or group.
  • Time-bucketed data if bucket size is specified.
  • Breakdown by allowed or blocked requests depending on the type filter.
  • Inclusion of threat-related data if security report is enabled.
  • Grouping by user ID if requested.

No binary data output is indicated for this operation.

Dependencies

  • Requires an API key credential for authentication to the external traffic reporting service.
  • The node communicates with a REST API endpoint that provides traffic report data.
  • Proper configuration of the API base URL and authentication headers is necessary.
  • Date/time inputs must be in valid UTC ISO8601 format for correct filtering.

Troubleshooting

  • Invalid date format errors: Ensure "From" and "To" properties are correctly formatted as YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ.
  • Empty or incomplete results: Check that filters like user IDs, agent IDs, or network IDs correspond to existing entities in the system.
  • Authentication failures: Verify that the API key credential is correctly configured and has sufficient permissions.
  • Unexpected data grouping: If "Show Individual Users" is false, results will be aggregated without user-level detail.
  • Bucket size misconfiguration: Using unsupported bucket sizes may cause the API to default to automatic bucketing or return errors.

Links and References

  • No direct links provided in the source code.
  • For further details, consult the API documentation of the traffic reporting service integrated with this node.

Discussion