{"type":"api","title":"Activity Proxy","meta":{"id":"/apps/pubhub/media/legacy-umbrella-api/bf58de618cbb72dda8f39b0414ce94c0a15cd467/ca1cb6ac-c651-3cb6-9746-527b35467f3c","info":{"title":"Reporting API","description":"The Reporting API provides the data to generate the reports as seen on the Umbrella dashboard.","version":"1.0.0","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"Activity"},{"name":"Top Identities"},{"name":"Identity Distribution"},{"name":"Top Destinations"},{"name":"Top Categories"},{"name":"Top Event Types"},{"name":"Top DNS query types"},{"name":"Organization Requests by Hour"},{"name":"Organization Requests by Timerange"},{"name":"Organization Requests by Hour and Category"},{"name":"Organization Requests by Timerange and Category"},{"name":"Deployment Status"},{"name":"MSP Deployment Status"},{"name":"MSP Requests by Hour"},{"name":"MSP Requests by Timerange"},{"name":"MSP Requests by Organization"},{"name":"MSP Requests by Category"},{"name":"MSP Requests by Destination"},{"name":"MSP Category Requests by Organization"},{"name":"Bandwidth by Hour"},{"name":"Bandwidth by Timerange"},{"name":"Top Files"},{"name":"Total Requests"},{"name":"Top Threats"},{"name":"Top Threat Types"},{"name":"Utility"},{"name":"Top IPs"},{"name":"Summary"},{"name":"Summaries by Category"},{"name":"Summaries by Destination"},{"name":"Summaries by Rule (Intrusion)"},{"name":"Remote Access"}],"x-parser-conf":{"oAuth2":{"clientId":"","clientSecret":"","proxyEnabled":true},"meta":{"useProxy":true}},"openapi":"3.0.1","servers":[{"url":"https://reports.api.umbrella.com/{basePath}","variables":{"basePath":{"default":"v2"}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"client credential flow","flows":{"clientCredentials":{"tokenUrl":"https://management.api.umbrella.com/auth/v2/oauth2/token","scopes":{}}}}}},"spec":{"tags":["Activity"],"summary":"Activity Proxy","description":"List all Proxy entries within timeframe.","operationId":"getActivityProxy","parameters":[{"name":"organizationid","in":"path","description":"The organization ID","required":true,"schema":{"type":"number"},"example":1234567,"$$ref":"#/components/parameters/organizationIdParam"},{"name":"from","in":"query","description":"A timestamp or relative time string (for example: '-1days').\nFilter for data that appears after this time.","required":true,"schema":{"type":"string"},"example":"1639146300000","$$ref":"#/components/parameters/fromParam"},{"name":"to","in":"query","description":"A timestamp or relative time string (for example: 'now').\nFilter for data that appears before this time.","required":true,"schema":{"type":"string"},"example":"1640010300000","$$ref":"#/components/parameters/toParam"},{"name":"order","in":"query","description":"A string that describes how to order the results\n(for example: 'asc' or 'desc').","schema":{"type":"string"},"example":"desc","$$ref":"#/components/parameters/orderParam"},{"name":"limit","in":"query","description":"The maximum number of records to return from the collection.","required":true,"schema":{"type":"number"},"example":100,"$$ref":"#/components/parameters/limitParam"},{"name":"offset","in":"query","description":"A number that represents an index into the collection.","schema":{"type":"number"},"example":0,"$$ref":"#/components/parameters/offsetParam"},{"name":"domains","in":"query","description":"A domain name or comma-delimited list of domain name.","schema":{"type":"string"},"example":"google.com,facebook.com","$$ref":"#/components/parameters/domainsParam"},{"name":"urls","in":"query","description":"A URL or comma-delimited list of URL.","schema":{"type":"string"},"example":"https://google.com,facebook.com/help","$$ref":"#/components/parameters/urlsParam"},{"name":"categories","in":"query","description":"A category ID or comma-delimited list of category ID.","schema":{"type":"string"},"example":"148,151,66","$$ref":"#/components/parameters/categoriesParam"},{"name":"policycategories","in":"query","description":"A category ID or comma-delimited list of category ID.\nFilter request by the categories that trigger a policy.","schema":{"type":"string"},"example":"67,69","$$ref":"#/components/parameters/policyCategoriesParam"},{"name":"ip","in":"query","description":"An IP address","schema":{"type":"string"},"example":"10.10.10.10","$$ref":"#/components/parameters/ipParam"},{"name":"ports","in":"query","description":"A port number or comma-delimited list of port number.","schema":{"type":"string"},"example":"7351,80","$$ref":"#/components/parameters/portsParam"},{"name":"identityids","in":"query","description":"An identity ID or comma-delimited list of identity ID.","schema":{"type":"string"},"example":"1,2,3","$$ref":"#/components/parameters/identityIdsParam"},{"name":"identitytypes","in":"query","description":"An identity type or comma-delimited list of identity type.","schema":{"type":"string"},"example":"network,roaming","$$ref":"#/components/parameters/identityTypesParam"},{"name":"applicationid","in":"query","description":"An application ID.","schema":{"type":"string"},"example":"1","$$ref":"#/components/parameters/applicationIdParam"},{"name":"verdict","in":"query","description":"A verdict string or comma-delimited list of verdict string.","schema":{"type":"string"},"example":"allowed,blocked,proxied","$$ref":"#/components/parameters/verdictParam"},{"name":"ruleid","in":"query","description":"A firewall policy rule ID.","schema":{"type":"number"},"example":1,"$$ref":"#/components/parameters/ruleIdParam"},{"name":"filename","in":"query","description":"A string that identifies a filename. Filter request by the filename.\nSupports globbing or use of the wildcard character ('*'). The asterisk (*) matches\nzero or more occurrences of any character.","schema":{"type":"string"},"example":"myfilename_*","$$ref":"#/components/parameters/filenameParam"},{"name":"securityoverridden","in":"query","description":"Specify whether to filter on requests that override security.","schema":{"type":"boolean"},"example":true,"$$ref":"#/components/parameters/securityOverriddenParam"},{"name":"bundleid","in":"query","description":"A proxy bundle ID.","schema":{"type":"number"},"example":1,"$$ref":"#/components/parameters/bundleIdParam"},{"name":"threats","in":"query","description":"A threat name or comma-delimited list of threat name.","schema":{"type":"string"},"$$ref":"#/components/parameters/threatsParam"},{"name":"threattypes","in":"query","description":"A threat type or comma-delimited list of threat type.","schema":{"type":"string"},"$$ref":"#/components/parameters/threatTypesParam"},{"name":"ampdisposition","in":"query","description":"An AMP disposition string or a comma-delimited list of AMP disposition string.","schema":{"type":"string"},"example":"clean,malicious,unknown","$$ref":"#/components/parameters/ampDispositionParam"},{"name":"antivirusthreats","in":"query","description":"A threat name or comma-delimited list of threat name.","schema":{"type":"string"},"example":"Trojan.Linux.Generic.144075","$$ref":"#/components/parameters/antivirusThreatsParam"},{"name":"tenantcontrols","in":"query","description":"If set to 'true', filter data for requests that are part of a tenant control policy.","schema":{"type":"boolean"},"example":true,"$$ref":"#/components/parameters/tenantControlsParam"},{"name":"isolatedstate","in":"query","description":"A string that describes the remote browser isolation\n(RBI) isolation type (for example: 'isolated' or 'not-isolated').","schema":{"type":"string","enum":["isolated","not-isolated"]},"example":"isolated","$$ref":"#/components/parameters/isolatedStateParam"},{"name":"isolatedFileAction","in":"query","description":"A string that describes the remote browser isolation (RBI) file action type\n(for example: 'viewed', 'downloaded-original-file', or 'downloaded-safe-pdf').","schema":{"type":"string","enum":["viewed","downloaded-original-file","downloaded-safe-pdf"]},"example":"downloaded-safe-pdf","$$ref":"#/components/parameters/isolatedFileActionParam"},{"name":"datalosspreventionstate","in":"query","description":"A string that describes the status of a destination (for example: 'blocked').\nFilter data for requests that were blocked to protect data.","schema":{"type":"string"},"example":"blocked","$$ref":"#/components/parameters/dataLossPreventionStateParam"},{"name":"httperrors","in":"query","description":"filter data for requests that resulted in a TLS error or a certificate error","schema":{"type":"string","enum":["certificateerror","tlserror"]},"example":"certificateerror","$$ref":"#/components/parameters/httpErrorsParam"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"externalip":{"type":"string","description":"external IP for entry"},"internalip":{"type":"string","description":"internal IP for entry"},"policycategories":{"type":"array","description":"array of policy categories","items":{"type":"object","description":"array of categories","properties":{"id":{"type":"number","description":"id of category"},"label":{"type":"string","description":"the human readable label of the category"},"type":{"type":"string","description":"the type of category"},"integration":{"type":"boolean","description":"if the category is an integration"},"deprecated":{"type":"boolean","description":"if the category is a legacy category"}},"$$ref":"#/components/schemas/Category"}},"categories":{"type":"array","description":"array of categories","items":{"type":"object","description":"array of categories","properties":{"id":{"type":"number","description":"id of category"},"label":{"type":"string","description":"the human readable label of the category"},"type":{"type":"string","description":"the type of category"},"integration":{"type":"boolean","description":"if the category is an integration"},"deprecated":{"type":"boolean","description":"if the category is a legacy category"}},"$$ref":"#/components/schemas/Category"}},"verdict":{"type":"string","description":"verdict for entry"},"timestamp":{"type":"number","description":"timestamp in ms","example":1594557263000,"$$ref":"#/components/schemas/Timestamp"},"identities":{"type":"array","description":"array of identities for entry","items":{"type":"object","properties":{"id":{"type":"number","description":"id of identity + organizationid: 957974 (number) - organization id for identity"},"label":{"type":"string","description":"label for identity"},"type":{"type":"object","properties":{"id":{"type":"number","description":"origin type for identity"},"label":{"type":"string","description":"origin type label for identity"},"type":{"type":"string","description":"origin type name for identity"}},"$$ref":"#/components/schemas/IdentityType"},"deleted":{"type":"boolean","description":"indicates whether the identity was deleted or not"}},"required":["id","label","type","deleted"],"example":{"id":1,"label":"Catch Rate Testing System","type":{"id":21,"label":"Sites","type":"site"},"deleted":false},"$$ref":"#/components/schemas/Identity"}},"allapplications":{"type":"array","description":"array of applications for entry","items":{"type":"object","properties":{"id":{"type":"number","description":"id of the application"},"label":{"type":"string","description":"label of the application"},"type":{"type":"string","description":"type of the application, NBAR or AVC"},"category":{"type":"object","description":"the category of the application","properties":{"id":{"type":"number","description":"id of the application category"},"label":{"type":"string","description":"label of the application category"}}}},"$$ref":"#/components/schemas/Application"}},"allowedapplications":{"type":"array","description":"array of allowed applications for entry","items":{"type":"object","properties":{"id":{"type":"number","description":"id of the application"},"label":{"type":"string","description":"label of the application"},"type":{"type":"string","description":"type of the application, NBAR or AVC"},"category":{"type":"object","description":"the category of the application","properties":{"id":{"type":"number","description":"id of the application category"},"label":{"type":"string","description":"label of the application category"}}}},"$$ref":"#/components/schemas/Application"}},"blockedapplications":{"type":"array","description":"array of blocked applications for entry","items":{"type":"object","properties":{"id":{"type":"number","description":"id of the application"},"label":{"type":"string","description":"label of the application"},"type":{"type":"string","description":"type of the application, NBAR or AVC"},"category":{"type":"object","description":"the category of the application","properties":{"id":{"type":"number","description":"id of the application category"},"label":{"type":"string","description":"label of the application category"}}}},"$$ref":"#/components/schemas/Application"}},"responsefilename":{"type":"string","description":"response filename for entry"},"blockedfiletype":{"type":"string","description":"blocked file type for entry"},"bundleid":{"type":"number","description":"bundleid"},"amp":{"type":"object","description":"AMP disposition/score/malware","properties":{"score":{"type":"number","description":"AMP score"},"disposition":{"type":"string","description":"AMP disposition"},"malware":{"type":"string","description":"AMP malware"}},"required":["disposition","malware","score"],"$$ref":"#/components/schemas/CiscoAMP"},"type":{"type":"string","description":"type of the request. A proxy request always has type proxy"},"tenantcontrols":{"type":"boolean","description":"if the request was part of a tenant control policy"},"port":{"type":"number","description":"request port","nullable":true},"antivirusthreats":{"type":"object","properties":{"puas":{"type":"array","description":"Potentially unwanted applications","items":{"type":"object"}},"viruses":{"type":"array","description":"Viruses","items":{"type":"string"}},"others":{"type":"array","description":"Other antivirus threats","items":{"type":"object"}}},"required":["others","puas","viruses"],"$$ref":"#/components/schemas/AntivirusThreats"},"policy":{"type":"object","required":["destinationlistids","ruleid","rulesetid","timebasedrule"],"properties":{"timebasedrule":{"type":"boolean","description":"whether the policy triggered a time-of-day rule"},"destinationlistids":{"type":"array","description":"the destination lists that the policy triggered","items":{"type":"number"}},"ruleid":{"type":"number","description":"the rule ID for the policy","nullable":true},"rulesetid":{"type":"number","description":"the rule set ID for the policy","nullable":true}},"$$ref":"#/components/schemas/Policy"},"requestmethod":{"type":"string","description":"The HTTP request method that was made.","example":"GET"},"responsesize":{"type":"number","description":"Response size in bytes."},"requestsize":{"type":"number","description":"Request size in bytes."},"statuscode":{"type":"number","description":"The HTTP status code; should always be 200 or 201.","example":200},"useragent":{"type":"string","description":"The browser agent that made the request."},"referer":{"type":"string","description":"The referring domain or URL."},"warnstatus":{"type":"string"},"sha256":{"type":"string","description":"The hex digest of the response content."},"isolated":{"type":"object","properties":{"state":{"type":"string"},"fileaction":{"type":"string"}},"required":["state","fileaction"],"example":{"state":"not-isolated","fileaction":""},"$$ref":"#/components/schemas/Isolated"},"datalossprevention":{"type":"object","properties":{"state":{"type":"string","description":"If the request was Blocked for DLP. Either 'blocked' or ''"}},"required":["state"],"example":{"state":"blocked"},"$$ref":"#/components/schemas/DataLossPreventionState"},"securityoverridden":{"type":"boolean"},"contenttype":{"type":"string","description":"The type of web content, typically text/html.","example":"text/html"},"forwardingmethod":{"type":"string","description":"The request method (GET, POST, HEAD, etc.)","example":"GET"},"httperrors":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","description":"type of the error `CertificateError` or `TLSError`"},"code":{"type":"number","description":"the http error code"},"reason":{"type":"string","description":"the name of the error"},"attributes":{"type":"object","description":"map of additional information about the error"}},"$$ref":"#/components/schemas/HttpError"},"description":"Certificate & TLS Errors"},"threats":{"type":"array","items":{"type":"object","properties":{"label":{"type":"string","description":"the threat name or label"},"type":{"type":"string","description":"the type of threat"}},"$$ref":"#/components/schemas/Threat"}},"egress":{"type":"object","properties":{"ip":{"type":"string","description":"Egress IP"},"type":{"type":"string","description":"Egress Type"}},"required":["ip","type"],"example":{"ip":"155.190.3.8","type":"shared"},"$$ref":"#/components/schemas/Egress"},"datacenter":{"type":"object","properties":{"id":{"type":"string","description":"Unique ID for the data center"},"label":{"type":"string","description":"Name of the data center"}},"required":["id","label"],"example":{"id":"LAX","label":"Los Angeles, US"},"$$ref":"#/components/schemas/DataCenter"},"date":{"type":"string","description":"the date from the timestamp based on the timezone parameter","example":"2020-07-12","$$ref":"#/components/schemas/Date"},"time":{"type":"string","description":"the time in 24 hour format based on the timezone parameter","example":"12:34","$$ref":"#/components/schemas/Time"},"destinationip":{"type":"string","description":"destination IP for entry","example":"12.10.10.10","$$ref":"#/components/schemas/DestinationIp"},"url":{"type":"string","description":"The URL requested"}},"required":["allapplications","allowedapplications","amp","antivirusthreats","blockedapplications","blockedfiletype","bundleid","categories","contenttype","datacenter","datalossprevention","date","destinationip","egress","externalip","forwardingmethod","httperrors","identities","internalip","isolated","policy","policycategories","port","referer","requestsize","responsefilename","responsesize","securityoverridden","sha256","statuscode","tenantcontrols","threats","time","timestamp","type","url","useragent","verdict","warnstatus"],"example":{"destinationip":"","externalip":"32.4.91.7","responsesize":3329530,"allapplications":[{"id":1313,"label":"Netflix","category":{"id":47,"label":"Media"}}],"date":"2022-02-18","datalossprevention":{"state":""},"antivirusthreats":{"puas":[],"viruses":[],"others":[]},"internalip":"192.168.1.43","referer":"","contenttype":"","tenantcontrols":false,"securityoverridden":false,"useragent":"","time":"23:29:42","amp":{"disposition":"","score":0,"malware":""},"policycategories":[],"type":"proxy","requestsize":1996,"port":443,"policy":{"ruleid":0,"rulesetid":0,"destinationlistids":[],"timebasedrule":false},"forwardingmethod":"","categories":[{"id":17,"type":"content","label":"Movies","integration":false,"deprecated":true}],"isolated":{"state":"not-isolated","fileaction":""},"statuscode":200,"egress":{"ip":"155.190.3.8","type":"shared"},"blockedfiletype":"","url":"https://ipv4-lax2-ix.1.oca.anothervideo.net","verdict":"allowed","responsefilename":"","warnstatus":"","sha256":"","timestamp":1645226982000,"blockedapplications":[],"allowedapplications":[],"identities":[{"id":1,"type":{"id":34,"type":"anyconnect","label":"Anyconnect Roaming Client"},"label":"Vincent's Macbook","deleted":false}],"datacenter":{"label":"Atlanta, US","id":"ATL"},"threats":[],"httperrors":[],"bundleid":3},"$$ref":"#/components/schemas/ActivityProxy"}},"meta":{"type":"object","example":{},"$$ref":"#/components/schemas/Meta"}},"required":["data","meta"]},"example":{"data":[{"destinationip":"","externalip":"32.4.91.7","responsesize":3329530,"allapplications":[{"id":1313,"label":"Netflix","category":{"id":47,"label":"Media"}}],"date":"2022-02-18","datalossprevention":{"state":""},"antivirusthreats":{"puas":[],"viruses":[],"others":[]},"internalip":"192.168.1.43","referer":"","contenttype":"","tenantcontrols":false,"securityoverridden":false,"useragent":"","time":"23:29:42","amp":{"disposition":"","score":0,"malware":""},"policycategories":[],"type":"proxy","requestsize":1996,"port":443,"policy":{"ruleid":0,"rulesetid":0,"destinationlistids":[],"timebasedrule":false},"forwardingmethod":"","categories":[{"id":17,"type":"content","label":"Movies","integration":false,"deprecated":true}],"isolated":{"state":"not-isolated","fileaction":""},"statuscode":200,"egress":{"ip":"155.190.3.8","type":"shared"},"blockedfiletype":"","url":"https://ipv4-lax2-ix.1.oca.anothervideo.net","verdict":"allowed","responsefilename":"","warnstatus":"","sha256":"","timestamp":1645226982000,"blockedapplications":[],"allowedapplications":[],"identities":[{"id":1,"type":{"id":34,"type":"anyconnect","label":"Anyconnect Roaming Client"},"label":"Vincent's Macbook","deleted":false}],"datacenter":{"label":"Los Angeles, US","id":"LAX"},"threats":[],"httperrors":[],"bundleid":3}],"meta":{}}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Invalid request"}}}},"$$ref":"#/components/responses/400Error"},"401":{"description":"Unauthorized request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Unauthorized request"}}}},"$$ref":"#/components/responses/401Error"},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Forbidden"}}}},"$$ref":"#/components/responses/403Error"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Not Found"}}}},"$$ref":"#/components/responses/404Error"},"500":{"description":"Server error","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Server error"}}}},"$$ref":"#/components/responses/500Error"}},"__originalOperationId":"getActivityProxy","security":[{"oauthFlow":[]}],"method":"get","path":"/organizations/{organizationid}/activity/proxy"}}