The App Discovery report displays Blocked Requests in two locations; App Grid (percentage of total) and App Details (count per identity). The follow explanation expands on the meaning of these statistics.
The Blocked % shows the percentage of DNS requests blocked for your Umbrella organization over the time period. The default time period is 90 days.
The Blocked column shows a count of blocked DNS requests for each identity in your Umbrella organization (for this specific app). The default time period is 90 days.
This data can be accessed in two ways:
- Clicking on the count of Identities in the main App Grid report
- Clicking on an App name followed by selecting the "Identities" tab
Filtering by Date
To get more recent data on the % of blocked traffic, the report can be filtered by date. This gives a better insight as to the effect of recent policy changes. This filter is available in both the App Grid and App Details.
For example, the main Apps Grid can be filtered to show blocked requests from yesterday:
The default time period is 90 days but can be filtered to a single day. Other date ranges are not currently available but are on the product roadmap.
It's important to remember the following:
- Each block represents an individual DNS request that was filtered by Umbrella.
- Some apps naturally generate more DNS requests than others. Some apps generate little DNS traffic even when in use, whereas others generate frequent requests even when idle. Umbrella counts the hits but is not aware of the intent of the user.
- All types of Umbrella DNS blocks are counted. This includes Security, Content, Destination List, Application and other blocks.
- Blocking an application is not expected to have any immediate impact on the App Discovery report...
- App Discovery data is only aggregated once per day
- The default view shows 90 days of data, so it may take some time to reflect 100% blocking.
Q) I've marked an App as "Not Approved", why isn't it being blocked?
"Not Approved" is a label to help with your workflow but does not physically block the App. You must block the app via other means, such as the "Application Settings" page:
Q) Is it possible to see a log of each individual blocked request?
The App Discovery report is not able to perform this level of "forensic" investigation currently. However, you can search for blocked Applications using the Umbrella "Activity Search". The Application filter is shown on the 'Advanced Search' dialog.
Currently this functionality only works for Apps which are supported for blocking (those in Application Settings).