umbrella-top-identities
Query top identities from Cisco Umbrella Reports.
Syntax
umbrella-top-identities [profile=PROFILE] [duration=DURATION] [from=FROM] [to=TO] [limit=LIMIT]
Options
- profile=PROFILE
- Optional. Cisco Umbrella connect profile code
- duration=DURATION
- Optional. Scan only recent data. Use s(second), m(minute), h(hour), d(day), mon(month) time unit.
- from=FROM
- Optional. Start time of range. yyyyMMddHHmmss format.
- to=TO
- Optional. End time of range. yyyyMMddHHmmss format.
- limit=LIMIT
- Optional. Maximum number of results (default: 100)
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Profile | Cisco Umbrella connect profile code |
| rank | Integer | Rank | e.g. 1 |
| identity | String | Identity | e.g. Logpresso_Guest |
| identity_type | String | Identity Type | e.g. network |
| requests | Integer | Requests | e.g. 48623 |
| allowed | Integer | Allowed | e.g. 48617 |
| blocked | Integer | Blocked | e.g. 6 |