umbrella_activity
Retrieve raw request-level activity logs from Cisco Umbrella for a specified time range, with optional breakdown by traffic type such as DNS, proxy, or firewall.
Instructions
Raw activity (request-level) log over a time range, optionally broken down by traffic type.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Range end, epoch milliseconds. | |
| from | Yes | Range start, epoch milliseconds. | |
| limit | No | Maximum number of records to return. | |
| offset | No | Number of records to skip, for paging. | |
| trafficType | No | Optional traffic-type breakdown. Omit for the all-traffic-types view. | |
| additionalParams | No | Escape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs. |