Download CSV with aggregate data

In an event, activity, and network traffic report, you can download a CSV that shows the total number of events, activity, or traffic based on the dimension you’ve selected in the report. For example, if you are showing event data based on category, the CSV shows the total number of events that were found in each category.

The CSV contains a maximum of 2500 entries for the dimension you've selected.

This operation is not available in a summary report.

To download a CSV with aggregate data:

1. In the Threat Protection menu of Enterprise Center, select Reports and go to the event, activity, or a traffic report that you want to view.
2. To filter data based on date and time, see Filter data based on date and time.
3. Select a dimension to define what data is shown in the report. For example, if you are viewing the DNS Activity report, you can show activity based on domain, location, and more.
4. In the table where data is grouped by the selected dimension, click Download Aggregate. A CSV with aggregate data is downloaded. The CSV shows the total numbers of events, activity, or queries based on the dimension you selected in the report. For example, if you selected domain as the dimension in the DNS Activity report, the CSV shows the total number of DNS queries based on the requested domain.