Overview
—
Daily verdict volume
Every policy decision the engine made, by day. Read from the hourly rollup, not the raw log.
Verdict mix by schedule state
The policy matrix at work: lunch relaxes, work enforces.
Block rate by location
Share of requests denied. A location with no reporting endpoints shows zero rather than dropping out.
Recreational traffic by hour of day
Social media, streaming and gaming. The midday dip is the lunch window relaxing the filters.
Blocked by category
Security categories stay enforced at every hour, lunch window included.
Most-requested destinations
Every destination the fleet asked for, with how each request was decided.
Traffic by inspection layer
Which engine produced the verdict: the DNS sinkhole, the SNI filter, or an endpoint agent.
Top users
The signed-in accounts behind the traffic, ranked by policy decisions in the selected slice. Select a row to see everything that person reached.
Top endpoints
The same traffic counted by machine rather than by person. A shared machine outranks its individual users here; a person who moves between machines outranks their machines above.
Top domains
All requested destinations, not just the blocked ones. Select a row to see who reached it.
Security incidents
Malware, phishing and cryptomining hits. These indicate a possibly compromised endpoint, not a policy annoyance.
Threat categories
Blocked volume per security classification.
Top work-hour violators
Blocked attempts inside an enforced Work window.
Endpoint health
Agent check-in state right now. This card reports current status, so the range filter does not apply to it.
Install an agent
Each endpoint runs two pieces: the service that enforces policy, and the status icon the user sees. Download both, then run the installer.
Application enforcement
What the Windows agents actually acted on locally.
Organisational units
Groups inherit the baseline and may override it locally. A client is matched to its group by longest-prefix on the source address.
Schedule windows
A higher priority wins where windows overlap, which is how lunch beats the enclosing work window.
Locations
—
—
Category access rules
Set the verdict for a whole content category.
General settings
How this gateway is configured.
Feeds
Downloaded into the DNS engine's in-memory trie. A feed that fails to fetch falls back to its on-disk cache, so an outage cannot silently empty the blocklist.
Content categories
Categories flagged for security are never released by the lunch-window relaxation. Toggle the classification to change whether a category survives the lunch window.
Top users
Who generated the most policy decisions in this slice.
Top domains
Every destination requested, permitted or not.
Top blocked destinations
What the engine actually denied, most often first.
Top blocked categories
Which kinds of content are being stopped.
Branch and warehouse compliance
Blueprint report 5.1, from v_group_compliance_30d, scoped to the selected range.
Lunch-window bypass
What the lunch relaxation let through, and what stayed blocked regardless.