AvantGuard - DNSFilter icon

AvantGuard - DNSFilter

AvantGuard - DNSFilter

Actions277

Overview

This node operation, Traffic Reports Total Threats Organizations, retrieves aggregated traffic threat data grouped by organizations. It is designed to provide insights into the total number of threats detected across multiple organizations within a specified time range and filtered by various criteria such as agent types, network IDs, application IDs, and more.

Typical use cases include:

  • Security teams monitoring threat activity across their managed organizations.
  • Network administrators analyzing threat trends over time.
  • Automated reporting systems generating summaries of blocked or allowed traffic threats.

For example, a user could configure this node to fetch all blocked threats from specific networks during the last 7 days, grouped by organization, to identify which organizations are most affected.

Properties

Name Meaning
Additional Query Parameters Optional filters and parameters to refine the report query. Includes:
- Agent Ids: Comma separated list of user agent UUIDs (default all)
- Agent Types: Comma separated list of user agent types (default all)
- Application Ids: Comma separated list of application IDs (default all)
- Bucket Size: Desired bucket size for aggregation; options: auto, 15min, 1day (default auto). Auto selects 15min if range <24h, else 1day.
- Collection Ids: Comma separated list of collection IDs (default all)
- From: Report start datetime in UTC (format YYYY-MM-DDThh:mm:ss or with Z), defaults to current UTC minus 1 day
- Mac Addresses: Comma separated MAC addresses without colons (default all)
- Network Ids: Comma separated list of network IDs (default all)
- Organization Ids: Comma separated list of organization IDs (default user org ID)
- Private Ip: Private LAN IP filter
- Private Ip From: Lower limit of private LAN IP range
- Private Ip To: Upper limit of private LAN IP range
- Show Individual Organizations: Boolean to group results by organization ID (default true)
- Source: Traffic source filter; options: all, networks, agents, proxies (default all)
- To: Report end datetime in UTC (format YYYY-MM-DDThh:mm:ss or with Z), defaults to current UTC
- Type: Type of report; options: all, allowed, blocked (default all)
- User Ids: Comma separated list of local user IDs (default all)

Output

The node outputs JSON data containing the aggregated threat report grouped by organizations according to the applied filters. The structure typically includes:

  • Organization identifiers.
  • Counts or totals of threats detected.
  • Breakdown by threat type or status (allowed, blocked).
  • Time-bucketed data if bucket size is specified.

If binary data output is supported, it would represent downloadable reports or raw data files, but this is not indicated in the provided code or properties.

Dependencies

  • Requires an API key credential for authenticating requests to the external traffic reporting service.
  • The node uses a base URL endpoint https://api.dnsfilter.com (inferred from bundled code context) to fetch data.
  • Proper configuration of the API authentication token in n8n credentials is necessary.

Troubleshooting

  • Invalid Date Format: If the "From" or "To" date strings are not in the expected ISO format, the API may reject the request or default to fallback dates. Ensure correct formatting.
  • Empty Results: Applying overly restrictive filters (e.g., very specific agent IDs or network IDs) might return no data. Try broadening filters.
  • Authentication Errors: Missing or invalid API keys will cause authorization failures. Verify that the API key credential is correctly set up.
  • API Rate Limits: Frequent or large queries may hit rate limits imposed by the external service. Implement retry logic or reduce query frequency.
  • Boolean Parameter Issues: The "Show Individual Organizations" parameter defaults to true; setting it incorrectly might affect grouping behavior.

Links and References

  • No direct links were found in the provided source code.
  • For further details, consult the official documentation of the traffic reporting API used by the node (likely DNSFilter or AvantGuard services).

Discussion