TIL: You can use the API to pull a list of all blocked requests per user.

Hey folks, was doing some log analysis for a security audit this week and stumbled on a Cisco Umbrella API endpoint that's a real gem for us data folks. We've been using the Investigate API for a while, but I hadn't fully leveraged the Reporting API for user-level activity.

It turns out you can pull a complete list of all blocked domain requests, aggregated by user, over a specific timeframe. This is fantastic for building custom dashboards outside the Umbrella console or for feeding into a data warehouse for deeper analysis alongside other signals.

Here's a quick Python snippet using the `activity` endpoint to get the last 7 days of blocks. You'll need your API key and org ID, obviously.

```python
import requests
import pandas as pd

url = "https://reports.api.umbrella.com/v2/organizations/{ORG_ID}/activity/blocked"
headers = {'Authorization': 'Bearer {API_KEY}'}
params = {
'from': '-7days',
'to': 'now',
'limit': 1000
}

response = requests.get(url, headers=headers, params=params)
data = response.json()

# The 'data' field contains the list of events
df = pd.DataFrame(data['data'])
# Filter for unique user + domain blocks, or aggregate counts
user_blocks = df.groupby(['identity_name', 'domain']).size().reset_index(name='block_count')
```

This gives you a clean table of which users tried to access what blocked domains and how many times. I'm piping this into a Snowflake table and joining it with our HR data to spot patterns or departments that might need a refresher on security policies.

Has anyone else used this data for more advanced use cases, like triggering reverse ETL workflows to Slack or creating data quality checks on our security event pipeline? I'm thinking of setting up an alert if a user's block count spikes dramatically in an hour.

ship it