Dnsfilter

Tool to get the total number of stats for a domain in a period of time. Use when you need to analyze domain-level request statistics including allowed, blocked, and threat requests within a specified time range.

Untrusted display-only summary

Gets the total number of DNS requests by domain for users in a period of time. Use this when you need to analyze domain traffic patterns across users or generate traffic reports. At least one query parameter must be provided for the endpoint to work successfully.

Untrusted display-only summary

Get the total number of DNS requests for organizations in a specified time period. Returns time-series data showing request volumes aggregated by configurable time buckets. Use this to analyze overall traffic patterns and monitor DNS query volumes across organizations. Supports extensive filtering by agents, applicati…

Untrusted display-only summary

Retrieves aggregated DNS traffic statistics across organizations for a specified time period. Returns total request counts (allowed, blocked, threats) and the organizations included in the report. Use this to monitor overall traffic patterns, identify security threats, and analyze DNS filtering effectiveness across yo…

Untrusted display-only summary

Get the total number of DNS requests over a specified time period. Returns time-series data showing DNS request volumes aggregated by configurable time buckets (15 minutes or 1 day). Use this to analyze traffic patterns, identify peak usage times, and monitor DNS request volumes broken down by allowed, blocked, and to…

Untrusted display-only summary

Get the total number of requests for roaming clients (user agents) during a specified time period. Use this to analyze overall traffic volume from roaming/mobile users, track request patterns over time, and monitor total DNS query activity across your roaming user base.

Untrusted display-only summary

Get the total number of requests for collections over a specified time period. Returns time-series data showing collection request volumes aggregated by configurable time buckets. Use this to analyze collection-specific traffic patterns and identify which collections are being used most frequently.

Untrusted display-only summary

Gets the total number of DNS requests by geographic location for organizations in a specified time period. Used for generating heatmap visualizations on the overview dashboard. Returns network IDs, organization IDs, and request counts grouped by geographic location.

Untrusted display-only summary

Get the total number of DNS requests for organizations in a specified time period. Returns time-series data showing request volumes aggregated by configurable time buckets (15 minutes or 1 day). Use this to analyze traffic patterns by organization, identify peak usage times, and monitor DNS request volumes broken down…

Untrusted display-only summary

Gets the total number of requests for users in a period of time. Use this to analyze DNS traffic patterns, monitor user activity, and generate reports on request volume. Supports extensive filtering by time range, user agents, networks, applications, and more. Results can be aggregated by different time buckets (15min…

Untrusted display-only summary

Gets the roaming clients information for the specified organization. Use this to retrieve roaming client statistics and deployment information across organizations.

Untrusted display-only summary

Get the total number of threats detected over a specified time period. Returns time-series data showing threat volumes aggregated by configurable time buckets (15 minutes or 1 day). Use this to monitor security threats, analyze threat patterns over time, and identify when threat activity is highest across networks and…

Untrusted display-only summary

Get the total number of threats for roaming clients in a period of time. Returns time-series data showing threat counts aggregated by configurable time buckets for agents (roaming clients). Use this to analyze security threat patterns and monitor blocked malicious domains or categories detected for roaming clients.

Untrusted display-only summary

Tool to retrieve the total number of threats for collections over a specified time period. Use when you need to analyze threat patterns, generate security reports, or monitor DNS-based threats blocked by DNSFilter across different collections.

Untrusted display-only summary

Get the total number of threats detected for organizations over a specified time period. Returns aggregated threat statistics showing how many malicious or dangerous DNS requests were identified across one or more organizations. Use this to monitor security posture, identify at-risk organizations, and track threat tre…

Untrusted display-only summary

Get the total number of threats for users in a period of time. Returns aggregated statistics showing security threats detected across users during the specified time range. Use this to monitor user-level threat activity and identify users encountering security issues.

Untrusted display-only summary

Tool to get user agent bulk delete counts by filtering criteria. Use when you need to determine how many user agents can be deleted or uninstalled and deleted based on various filters like agent state, network, tags, or online/offline status.

Untrusted display-only summary

Tool to get user agent bulk delete counts by filters. Use when you need to determine how many user agents match certain criteria and whether they support remote uninstall. Returns counts of agents that can be deleted vs agents that can be both uninstalled and deleted.

Untrusted display-only summary

Gets a list of latest user agent releases for each unique combination of agent_type, architecture, release_channels, and white label. Use this to discover available agent versions for deployment across different platforms and release channels.

Untrusted display-only summary

Tool to get a list of latest relay releases for each unique combination of architecture, release channels, and white label. Use when you need to retrieve available relay agent versions for deployment or updates.

Untrusted display-only summary

Tool to retrieve ALL user agents with basic information. Use when you need a comprehensive list of all user agents, optionally filtered by network, organization, state, status, or tags. Supports pagination and sorting.

Untrusted display-only summary

Tool to get counts of user agents for each status. Use when you need to retrieve statistics about user agents grouped by their protection status (protected, unprotected, bypassed, etc.). Supports filtering by organization, network, tags, and various other criteria.

Untrusted display-only summary

Tool to export user agents as CSV data for a specific organization. Use when you need to retrieve a CSV-formatted list of user agents, optionally including suborg data.

Untrusted display-only summary

Retrieves all tags used by user agents on a network or organization. Tags help categorize and organize user agents for easier management and policy application. Use when you need to view available tags for filtering or grouping user agents.

Untrusted display-only summary

Tool to get all users basic information with optional pagination. Use when you need to retrieve a list of users in the organization with their profile details including name, email, and contact information.

Untrusted display-only summary

Tool to get basic network information based on an IP address lookup. Use when you need to identify which network an IP belongs to and retrieve its block page configuration settings.

Untrusted display-only summary

Removes a single application from the allow list of a policy in DNSFilter. Use this action when you need to revoke access for a specific application that was previously allowed. The application will be removed from the policy's allow_applications list and will no longer bypass filtering rules. This is useful for tight…

Untrusted display-only summary

Tool to remove one or more domains from one or more policies' allow lists. Use when you need to bulk remove previously allowed domains from multiple policies at once, useful for security updates or policy cleanup.

Untrusted display-only summary

Tool to remove a single category from a policy's blocklist. Use when you need to unblock a specific content category that was previously restricted in a DNS filtering policy. The category will be removed from the policy's blacklist_categories array, allowing domains in that category to be accessed.

Untrusted display-only summary

Tool to remove a single domain from a policy's blocklist. Use when you need to unblock a specific domain that was previously blocked by a policy, such as when correcting false positives or updating filtering rules. The domain will be removed from the specified policy's blacklist_domains list.

Untrusted display-only summary