Cyber Shield - Observed Domains Trend Analysis
Prerequisites
You must configure your Cyber Shield Domain Filtering to enable monitoring. More details on domain filtering can be found here: Configuring Cyber Shield Domain Filtering.
Analyze Observed Domains Trends
The Timeframe Metrics dashboard displays events for Observed Domains and Blocked Domains by category for a selected period of the previous 30 days. These metrics also include the Average Hourly Volume, Maximum Hourly Volume, and Minimum Hourly Volume of Observed or Blocked Domains for a selected period (24 hours, 7 days, 30 days). You may drill down to a more detailed report by category from the 7 days and 30 days ranges.
Access the Cyber Shield page in the Administration portal.
Click the Timeframe Metrics pane.
The Observed Traffic, Blocked Traffic, Observed Domains, and Blocked Domains windows open. By default, the Observed Domains tab is active and the page displays a count of observed domain name queries over the last 24 hours. Note that the Classification Data section displays a breakdown of the observed domain content categories.
Change the timeframe for the reporting data with the radio buttons on the right.
Drill down to a specific week by clicking on a day in the chart.
Note
The data and timeframe changes dynamically in the bar chart. You can drill further down to a specific day, and an hourly view is available for each day out of the last seven.
Steps: Timeframe Metrics
From the Cyber Shield page, click the Timeframe Metrics panel.
Choose either the Observed Domains or Blocked Domains tabs.
To choose a specific timeframe, toggle the time settings (24 hours, 7 days, 30 days) to the desired period.
To drill down and view a breakdown by Observed or Blocked Domains by category for a selected day, toggle either the 7 days or 30 days timeframe buttons. This allows a drill-down from 30 days to 7 days, and from 7 days to a specific day.
Click a bar from the chart.
