The following shows how to generate the security-analytics-gtm-nxdomain-spikes report using either the Reporting API's Generate a report POST operation or the Get a cacheable report GET operation. Details about each report's supported products, metrics, filters, and available data intervals are also available dynamically by running the API's Get a report type operation, also shown below. See also other available reports.

Report definition

This report shows NXDOMAIN spikes for GTM domains.

Business object: fpdomain

Data available for: 90 days

Available metrics

Metric	Description
Data metrics
`algo`	`algo` is either `DYNAMIC` or `ABSOLUTE`. `ABSOLUTE` is shown if NXDOMAIN responses/sec is greater than the threshold value configured in infrastructure security analytics as a spike. `DYNAMIC` is shown if NXDOMAIN responses/sec is greater than the threshold value (x standard deviations) from the 24 hour moving average that was configured in infrastructure security analytics.
`domainName`	GTM domain.
`duration`	Duration of NXDOMAIN spike.
`durationMinutes`	Duration of the NXDOMAIN spike in minutes.
`endTime`	Date and time when the NXDOMAIN spike ended.
`investigateLink`	Link to the Infrastructure Security Analytics - GTM NXDOMAIN Spike Details report in Control Center.
`startTime`	Date and time when the NXDOMAIN spike started.
`threshold`	Threshold for NXDOMAINs that has been reached.
`totalNxdomains`	Total number of NXDOMAIN responses.
`totalQueries`	Total number of DNS requests.

POST request

POST /reporting-api/v1/reports/security-analytics-gtm-nxdomain-spikes/versions/1/report-data{?start,end}

Sample: /reporting-api/v1/reports/security-analytics-gtm-nxdomain-spikes/versions/1/report-data?start=2026-02-01T00%3A00%3A00Z&end=2026-03-01T00%3A00%3A00Z

Query parameters

Parameter	Type	Sample	Description
Required
`start`	String	`2026-02-01T00:00:00Z`	Specifies the start of the reported period as an ISO-8601 timestamp with optional time zone. The report includes data that matches the `start` value’s timestamp.
`end`	String	`2026-03-01T00:00:00Z`	Specifies the end of the reported period as an ISO-8601 timestamp with optional time zone. The report excludes any data that matches the `end` value’s timestamp.

JSON request members

Member	Type	Description
`objectIds`	Array	Specifies the set of `fpdomain` values you want to report on.
`objectIds`	Enumeration	As an alternative to an array of ID values, specify `all` as a string for unfiltered data. Either way, `objectIds` is required.
`metrics`	Array	The set of desired metrics. If omitted, the report includes all available metrics.

Request body:

{
    "objectIds": [
        "www.example.com",
        "m.example.com",
        "blog.example.com"
    ],
    "metrics": [
        "algo",
        "domainName",
        "duration",
        "durationMinutes",
        "endTime",
        "investigateLink",
        "startTime",
        "threshold",
        "totalNxdomains",
        "totalQueries"
    ]
}

GET request

GET /reporting-api/v1/reports/security-analytics-gtm-nxdomain-spikes/versions/1/report-data{?start,end,objectIds,allObjectIds,metrics}

Sample: /reporting-api/v1/reports/security-analytics-gtm-nxdomain-spikes/versions/1/report-data?start=2026-02-01T00%3A00%3A00Z&end=2026-03-01T00%3A00%3A00Z&objectIds=www.example.com,m.example.com,blog.example.com,example.com,testdomain.com,example1.com,testdomain1.com,example2.com&metrics=algo%2CdomainName

Query parameters

Parameter	Type	Sample	Description
Required
`start`	String	`2026-02-01T00:00:00Z`	Specifies the start of the reported period as an ISO-8601 timestamp with optional time zone. The report includes data that matches the `start` value’s timestamp.
`end`	String	`2026-03-01T00:00:00Z`	Specifies the end of the reported period as an ISO-8601 timestamp with optional time zone. The report excludes any data that matches the `end` value’s timestamp.
Optional
`allObjectIds`	Boolean	`true`	As an alternative to `objectIds`, enabling this generates a report that includes all IDs available for the `fpdomain` objectType. This parameter is ignored if the request also specifies a set of objectIds.
`objectIds`	String	`www.example.com,m.example.com,blog.example.com, example.com, testdomain.com, example1.com, testdomain1.com, example2.com`	As an alternative to `allObjectIds`, specifies the set of unique IDs for the `fpdomain` objectType you want to report on, formatted as a comma-delimited list.
`metrics`	String	`algo,domainName`	Specifies a comma-separated list of metrics to include in the report, otherwise all metrics if omitted. The set of available metrics depends on the type of report. URL-encode the entire value in the GET request.

JSON response

Status 200 application/json

Response body:

{
    "metadata": {
        "name": "security-analytics-gtm-nxdomain-spikes",
        "version": "1",
        "outputType": "FLAT",
        "groupBy": [
            "domainName",
            "startTime"
        ],
        "start": "2026-02-01T00:00:00Z",
        "end": "2026-03-01T00:00:00Z",
        "availableDataEnds": null,
        "suggestedRetryTime": null,
        "rowCount": 4,
        "filters": [],
        "columns": [
            {
                "name": "groupBy",
                "label": "domainName"
            },
            {
                "name": "groupBy",
                "label": "startTime"
            },
            {
                "name": "algo",
                "label": "Algorithm"
            },
            {
                "name": "domainName",
                "label": "Domain Name"
            },
            {
                "name": "duration",
                "label": "Duration"
            },
            {
                "name": "durationMinutes",
                "label": "Duration (min)"
            },
            {
                "name": "endTime",
                "label": "End Time"
            },
            {
                "name": "investigateLink",
                "label": "Investigate Link"
            },
            {
                "name": "startTime",
                "label": "Start Time"
            },
            {
                "name": "threshold",
                "label": "Threshold"
            },
            {
                "name": "totalNxdomains",
                "label": "Total NXDOMAIN Responses"
            },
            {
                "name": "totalQueries",
                "label": "Total Queries"
            }
        ],
        "objectType": "fpdomain",
        "objectIds": [
            "www.example.com",
            "m.example.com",
            "blog.example.com",
            "example.com",
            "testdomain.com",
            "example1.com",
            "testdomain1.com",
            "example2.com"
        ]
    },
    "data": [
       {
           "domainName": "example.com",
           "startTime": "2026-01-23 07:00:00 +00:00",
           "algo": "ABSOLUTE",
           "duration": "15 minutes",
           "durationMinutes": 15,
           "endTime": "2026-01-23 07:15:00 +00:00",
           "investigateLink": "/apps/reports/#/dashboard/security-analytics-gtm-nxdomain-spike-details?start=2023-04-01T10:00:00Z&end=2023-04-01T12:00:00Z",
           "threshold": 2772,
           "totalNxdomains": 4214,
           "totalQueries": 8170
       },
       {
           "domainName": "testdomain.com",
           "startTime":  "2026-01-23 07:20:00 +00:00",
           "algo": "DYNAMIC",
           "duration": "20 minutes",
           "durationMinutes": 20,
           "endTime": "2026-01-23 07:40:00 +00:00",
           "investigateLink": "/apps/reports/#/dashboard/security-analytics-gtm-nxdomain-spike-details?start=2023-04-01T10:00:00Z&end=2023-04-01T12:00:00Z",
           "threshold": 2435,
           "totalNxdomains": 3637,
           "totalQueries": 9280
       },
       {
           "domainName": "example1.com",
           "startTime": "2026-01-23 09:00:00 +00:00",
           "algo": "ABSOLUTE",
           "duration": "45 minutes",
           "durationMinutes": 45,
           "endTime": "2026-01-23 09:45:00 +00:00",
           "investigateLink": "/apps/reports/#/dashboard/security-analytics-gtm-nxdomain-spike-details?start=2023-04-01T10:00:00Z&end=2023-04-01T12:00:00Z",
           "threshold": 277,
           "totalNxdomains": 421,
           "totalQueries": 817
       },
       {
            "domainName": "testdomain1.com",
           "startTime":  "2026-01-23 10:00:00 +00:00",
           "algo": "DYNAMIC",
           "duration": "10 minutes",
           "durationMinutes": 10,
           "endTime": "2026-01-23 10:10:00 +00:00",
           "investigateLink": "/apps/reports/#/dashboard/security-analytics-gtm-nxdomain-spike-details?start=2023-04-01T10:00:00Z&end=2023-04-01T12:00:00Z",
           "threshold": 243,
           "totalNxdomains": 363,
           "totalQueries": 928
       }
   ],

    "summaryStatistics": {}
}

Get report details

This sample Get a report type operation gets the same information you need to run the security-analytics-gtm-nxdomain-spikes report as provided in this reference documentation, but available dynamically to your API client application.

GET /reporting-api/v1/reports/security-analytics-gtm-nxdomain-spikes/versions/1

Status 200 application/json

Response body:

{
    "name": "security-analytics-gtm-nxdomain-spikes",
    "description": "This report shows NXDOMAIN spikes for GTM domains.",
    "businessObjectName": "fpdomain",
    "version": 1,
    "status": "PUBLISHED",
    "deprecated": false,
    "timeBased": false,
    "supportsPagination": false,
    "outputType": "FLAT",
    "available": true,
    "metrics": [
        {
            "name": "domainName",
            "description": "GTM domain.",
            "label": "Domain Name",
            "unit": "STRING",
            "summaryStatistic": false
        },
        {
            "name": "startTime",
            "description": "Date and time when the  NXDOMAIN spike started.",
            "label": "Start Time",
            "unit": "STRING",
            "summaryStatistic": false
        },
        {
            "name": "endTime",
            "description": "Date and time when the NXDOMAIN spike ended.",
            "label": "End Time",
            "unit": "STRING",
            "summaryStatistic": false
        },
        {
            "name": "duration",
            "description": "Duration of NXDOMAIN spike.",
            "label": "Duration",
            "unit": "STRING",
            "summaryStatistic": false
        },
        {
            "name": "durationMinutes",
            "description": "Duration of the NXDOMAIN spike in minutes.",
            "label": "Duration (min)",
            "unit": "COUNT",
            "summaryStatistic": false
        },
        {
            "name": "totalQueries",
            "description": "Total number of DNS requests.",
            "label": "Total Queries",
            "unit": "COUNT",
            "summaryStatistic": false
        },
        {
            "name": "totalNxdomains",
            "description": "Total number of NXDOMAIN responses.",
            "label": "Total NXDOMAIN Responses",
            "unit": "COUNT",
            "summaryStatistic": false
        },
        {
            "name": "investigateLink",
            "description": "Link to the Infrastructure Security Analytics - GTM NXDOMAIN Spike Details report in Control Center.",
            "label": "Investigate Link",
            "unit": "STRING",
            "summaryStatistic": false
        },
        {
            "name": "algo",
            "description": "`algo` is either `DYNAMIC` or `ABSOLUTE`. `ABSOLUTE` is shown if NXDOMAIN responses/sec is greater than the threshold value configured in infrastructure security analytics as a spike. `DYNAMIC` algo is shown if NXDOAMAIN responses/sec is greater than the threshold value (x standard deviations) from the 24 hour moving average that was configured in infrastructure security analytics.",
            "label": "Algorithm",
            "unit": "STRING",
            "summaryStatistic": false
        },
        {
            "name": "threshold",
            "description": "Threshold for NXDOMAINs that has been reached.",
            "label": "Threshold",
            "unit": "COUNT",
            "summaryStatistic": false
        }
    ],
    "groupOutlyingValues": {
        "enabled": false
    },
    "groupBy": [
        "domainName",
        "startTime"
    ],
    "intervals": [
        "FIVE_MINUTES"
    ],
    "dataRetentionDays": 90,
    "links": [
        {
            "rel": "self",
            "href": "/reporting-api/v1/reports/security-analytics-gtm-nxdomain-spikes/versions/1"
        },
        {
            "rel": "versions",
            "href": "/reporting-api/v1/reports/security-analytics-gtm-nxdomain-spikes/versions"
        },
        {
            "rel": "all-reports",
            "href": "/reporting-api/v1/reports"
        },
        {
            "rel": "execute-report",
            "href": "/reporting-api/v1/reports/security-analytics-gtm-nxdomain-spikes/versions/1/report-data"
        }
    ]
}