cisco_umbrella_get_activity_proxy
Retrieve proxy activity events from Cisco Umbrella's Secure Web Gateway. Filter by domains, URLs, verdict, threats, or time range to investigate web traffic and security incidents.
Instructions
List proxy (Secure Web Gateway) activity events.
API: GET /reports/v2/activity/proxy
Args:
from_: Required. Start of the time range. Accepts epoch
milliseconds, ISO-8601 (e.g. "2024-01-01T00:00:00Z"), or a
relative offset (e.g. "-1days", "-7days", "now").
to: Required. End of the time range. Same accepted formats as from_.
limit: Max results per page (default 100).
offset: Pagination offset.
domains: Comma-separated domain filter.
urls: Comma-separated URL filter.
categories: Comma-separated content category ID filter.
identityids: Comma-separated identity ID filter.
verdict: Filter by verdict, e.g. "allowed" or "blocked".
threats: Comma-separated threat name filter.
filename: Filter by downloaded file name.
timezone: IANA timezone name for the response's time fields.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| urls | No | ||
| from_ | Yes | ||
| limit | No | ||
| offset | No | ||
| domains | No | ||
| threats | No | ||
| verdict | No | ||
| filename | No | ||
| timezone | No | ||
| categories | No | ||
| identityids | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |