Filter DNS activity data

Complete this procedure to filter DNS activity data.

You must be an ETP administrator or a user with a specific permission to view the DNS Activity report. For more information, see Enterprise Threat Protector roles.

How to

  1. In the Enterprise Center navigation menu, select Threat Analytics > Activity > DNS Activity.
  2. To filter data based on date and time, see Filter data based on date and time.
  3. To configure and apply a filter, see Configure and apply a filter.
  4. To further narrow the date and time that you want to report on, move the slider handles of the provided graph to select the desired area or the date and time you want to focus on. For example, you may want to focus on the time when the most activity occurred.
  5. Select a dimension or criteria to define what data is shown.
  6. To hide data shown in the top 6 area, click one of the top 6 items. This data is hidden from the Top 6 graph. Likewise, you can click it again to show this data in the graph.
  7. To search for DNS traffic that's grouped by the selected dimension, see Search for DNS traffic.