AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter
Join our community

Actions277

Overview

This node operation, Traffic Reports Total Threats Collections, retrieves aggregated traffic threat data grouped by collections from a security or network monitoring service. It allows users to query total threats detected across various collections within specified time ranges and filter criteria.

Typical use cases include:

  • Security analysts wanting to monitor threat activity trends over time.
  • Network administrators tracking blocked or allowed traffic incidents by collection.
  • Automated reporting workflows that summarize threat data for compliance or auditing.

For example, a user could request the total number of blocked threats in the last 7 days, grouped by collection IDs, filtered to specific agent types or networks.

Properties

Name Meaning
Additional Query Parameters Optional filters and parameters to refine the report query. Includes:
- Agent Ids: Comma-separated list of user agent UUIDs (default all)
- Agent Types: Comma-separated list of user agent types (default all)
- Application Ids: Comma-separated list of application IDs (default all)
- Bucket Size: Desired bucket size for aggregation; options are auto, 15min, 1day (default auto)
- Collection Ids: Comma-separated list of collection IDs (default all)
- From: UTC start datetime for report range (format YYYY-MM-DDThh:mm:ss or with Z)
- Mac Addresses: Comma-separated MAC addresses without colons (default all)
- Network Ids: Comma-separated list of network IDs (default all)
- Organization Ids: Comma-separated list of organization IDs (default current user org)
- Private Ip: Specific private LAN IP
- Private Ip From/To: Range for private LAN IPs
- Show Individual Collections: Boolean to group results by collection ID (default true)
- Source: Traffic source filter; options are all, networks, agents, proxies (default all)
- To: UTC end datetime for report range (format YYYY-MM-DDThh:mm:ss or with Z)
- Type: Report type filter; options are all, allowed, blocked (default all)
- User Ids: Comma-separated list of local user IDs (default all)

Output

The node outputs JSON data representing the aggregated threat report grouped by collections according to the specified filters and time range. The structure typically includes:

  • Collection identifiers
  • Aggregated counts of threats (total, allowed, blocked)
  • Time buckets if bucket size is specified
  • Breakdown by source or other dimensions if requested

No binary data output is indicated.

Dependencies

  • Requires an API key credential for authenticating with the external traffic/security reporting service.
  • The base URL for API requests is set to https://api.dnsfilter.com.
  • The node uses standard HTTP headers accepting and sending JSON content.
  • No additional environment variables are explicitly required beyond the API authentication.

Troubleshooting

  • Invalid Date Format: If the from or to date strings are not in the expected ISO format, the API may default to current date/time or return errors. Ensure correct formatting.
  • Empty Results: Using overly restrictive filters (e.g., specific agent IDs or collection IDs) might yield no data. Try broadening filters.
  • Authentication Errors: Missing or invalid API credentials will cause authorization failures. Verify the API key is correctly configured.
  • Unsupported Bucket Size: Providing an unsupported bucket size value may cause the API to reject the request. Use only auto, 15min, or 1day.
  • Boolean Parameter Issues: The show_individual_collections must be boolean; passing string values may cause unexpected behavior.

Links and References

Discussion