The following shows how to generate the security-analytics-proxy-nxdomain-spikes report using either the Reporting API's Generate a report POST operation or the Get a cacheable report GET operation. Details about each report's supported products, metrics, filters, and available data intervals are also available dynamically by running the API's Get a report type operation, also shown below. See also other available reports.
Report definition
This report shows NXDOMAIN spikes detected for your shield configuration.
Business object: serviceInstanceId
Data available for: 90 days
Available metrics
| Metric | Description |
|---|---|
| Data metrics | |
algo | algo is either DYNAMIC or ABSOLUTE. ABSOLUTE is shown if NXDOMAIN responses/sec is greater than the threshold value configured in infrastructure security analytics as a spike. DYNAMIC is shown if NXDOMAIN responses/sec is greater than the threshold value (x standard deviations) from the 24 hour moving average that was configured in the app. |
duration | Duration of the NXDOMAIN spike. |
endTime | Date and time when the NXDOMAIN spike ended in ISO-8601 timestamp format with a UTC offset. |
investigateLink | Link to the Shield NS53 Proxy Queries report in Control Center. |
proxyId | The proxyId is a GUID identifier for the shield. For example, 0e9b1a11-cafb-4d44-b481-96aa6a2d92ba. |
proxyName | Name of the shield. |
serviceInstanceId | Unique identification number assigned to a shield configuration. |
startTime | Date and time when the NXDOMAIN spike started in ISO-8601 timestamp format with a UTC offset. |
threshold | Threshold for NXDOMAINs that has been reached. |
totalNxdomains | Total number of detected NXDOMAINs. |
totalQueries | Total number of queries that were processed by the shield configuration. |
POST request
POST /reporting-api/v1/reports/security-analytics-proxy-nxdomain-spikes/versions/1/report-data{?start,end}
Sample: /reporting-api/v1/reports/security-analytics-proxy-nxdomain-spikes/versions/1/report-data?start=2026-02-01T00%3A00%3A00Z&end=2026-03-01T00%3A00%3A00Z
Query parameters
| Parameter | Type | Sample | Description |
|---|---|---|---|
| Required | |||
start | String | 2026-02-01T00:00:00Z | Specifies the start of the reported period as an ISO-8601 timestamp with optional time zone. The report includes data that matches the start value’s timestamp. |
end | String | 2026-03-01T00:00:00Z | Specifies the end of the reported period as an ISO-8601 timestamp with optional time zone. The report excludes any data that matches the end value’s timestamp. |
JSON request members
| Member | Type | Description |
|---|---|---|
objectIds | Array | Specifies the set of serviceInstanceId values you want to report on. |
objectIds | Enumeration | As an alternative to an array of ID values, specify all as a string for unfiltered data. Either way, objectIds is required. |
metrics | Array | The set of desired metrics. If omitted, the report includes all available metrics. |
Request body:
{
"objectIds": [
"1111",
"1122",
"2222",
"2233",
"52",
"53",
"54",
"55"
],
"metrics": [
"algo",
"duration",
"endTime",
"investigateLink",
"proxyId",
"proxyName",
"serviceInstanceId",
"startTime",
"threshold",
"totalNxdomains",
"totalQueries"
]
}GET request
GET /reporting-api/v1/reports/security-analytics-proxy-nxdomain-spikes/versions/1/report-data{?start,end,objectIds,allObjectIds,metrics}
Sample: /reporting-api/v1/reports/security-analytics-proxy-nxdomain-spikes/versions/1/report-data?start=2026-02-01T00%3A00%3A00Z&end=2026-03-01T00%3A00%3A00Z&objectIds=1111,1122,2222,2233,52,53,54,55&metrics=algo%2Cduration
Query parameters
| Parameter | Type | Sample | Description |
|---|---|---|---|
| Required | |||
start | String | 2026-02-01T00:00:00Z | Specifies the start of the reported period as an ISO-8601 timestamp with optional time zone. The report includes data that matches the start value’s timestamp. |
end | String | 2026-03-01T00:00:00Z | Specifies the end of the reported period as an ISO-8601 timestamp with optional time zone. The report excludes any data that matches the end value’s timestamp. |
| Optional | |||
allObjectIds | Boolean | true | As an alternative to objectIds, enabling this generates a report that includes all IDs available for the serviceInstanceId objectType. This parameter is ignored if the request also specifies a set of objectIds. |
objectIds | String | 1111,1122,2222,2233,52,53,54,55 | As an alternative to allObjectIds, specifies the set of unique IDs for the serviceInstanceId objectType you want to report on, formatted as a comma-delimited list. |
metrics | String | algo,duration | Specifies a comma-separated list of metrics to include in the report, otherwise all metrics if omitted. The set of available metrics depends on the type of report. URL-encode the entire value in the GET request. |
JSON response
Status 200 application/json
Response body:
{
"metadata": {
"name": "security-analytics-proxy-nxdomain-spikes",
"version": "1",
"outputType": "FLAT",
"groupBy": [
"proxyId",
"startTime"
],
"start": "2025-12-01T00:00:00Z",
"end": "2026-01-01T00:00:00Z",
"availableDataEnds": null,
"suggestedRetryTime": null,
"rowCount": 4,
"filters": [],
"columns": [
{
"name": "groupBy",
"label": "proxyId"
},
{
"name": "groupBy",
"label": "startTime"
},
{
"name": "algo",
"label": "Algorithm"
},
{
"name": "duration",
"label": "Duration"
},
{
"name": "endTime",
"label": "End Time"
},
{
"name": "investigateLink",
"label": "Investigate Link"
},
{
"name": "proxyId",
"label": "Proxy ID"
},
{
"name": "proxyName",
"label": "Proxy Name"
},
{
"name": "serviceInstanceId",
"label": "Service Instance ID"
},
{
"name": "startTime",
"label": "Start Time"
},
{
"name": "threshold",
"label": "Threshold"
},
{
"name": "totalNxdomains",
"label": "Total NXDOMAIN Responses"
},
{
"name": "totalQueries",
"label": "Total Queries"
}
],
"objectType": "serviceInstanceId",
"objectIds": [
"1111",
"1122",
"2222",
"2233",
"52",
"53",
"54",
"55"
]
},
"data": [
{
"proxyId": "0e9b1a11-cafb-4d44-b481-96aa6a2d92ba",
"startTime": "2026-01-23 07:00:00 +00:00",
"algo": "ABSOLUTE",
"duration": 5,
"endTime": "2026-01-23 08:00:00 +00:00",
"investigateLink": "/apps/reports/#/dashboard/authoritative-dns-proxy-sps?service-instance-id-name=52&start=2023-04-01T10:00:00Z&end=2023-04-01T12:00:00Z",
"proxyName": "proxy1.example.com",
"serviceInstanceId": "52",
"threshold": "3066",
"totalNxdomains": "4794",
"totalQueries": "14190"
},
{
"proxyId": "0e9b2b22-cafb-4d44-b481-96aa6a2d92ba",
"startTime": "2026-01-23 07:00:00 +00:00",
"algo": "DYNAMIC",
"duration": 12,
"endTime": "2026-01-23 08:00:00 +00:00",
"investigateLink": "/apps/reports/#/dashboard/authoritative-dns-proxy-sps?service-instance-id-name=53&start=2023-04-01T10:00:00Z&end=2023-04-01T12:00:00Z",
"proxyName": "proxy2.example.com",
"serviceInstanceId": "53",
"threshold": "2629",
"totalNxdomains": "3998",
"totalQueries": "12170"
},
{
"proxyId": "0e9b3c33-cafb-4d44-b481-96aa6a2d92ba",
"startTime": "2026-01-23 07:00:00 +00:00",
"algo": "DYNAMIC",
"duration": 12,
"endTime": "2026-01-23 08:00:00 +00:00",
"investigateLink": "/apps/reports/#/dashboard/authoritative-dns-proxy-sps?service-instance-id-name=54&start=2023-04-01T10:00:00Z&end=2023-04-01T12:00:00Z",
"proxyName": "proxy3.example.com",
"serviceInstanceId": "54",
"threshold": "4193",
"totalNxdomains": "4562",
"totalQueries": "2530"
},
{
"proxyId": "0e9b4d44-cafb-4d44-b481-96aa6a2d92ba",
"startTime": "2026-01-23 07:00:00 +00:00",
"algo": "ABSOLUTE",
"duration": 20,
"endTime": "2026-01-23 08:00:00 +00:00",
"investigateLink": "/apps/reports/#/dashboard/authoritative-dns-proxy-sps?service-instance-id-name=55&start=2023-04-01T10:00:00Z&end=2023-04-01T12:00:00Z",
"proxyName": "proxy.example.com",
"serviceInstanceId": "55",
"threshold": "1520",
"totalNxdomains": "2534",
"totalQueries": "25190"
}
],
"summaryStatistics": {}
}Get report details
This sample Get a report type operation gets the same information you need to run the security-analytics-proxy-nxdomain-spikes report as provided in this reference documentation, but available dynamically to your API client application.
GET /reporting-api/v1/reports/security-analytics-proxy-nxdomain-spikes/versions/1
Status 200 application/json
Response body:
{
"name": "security-analytics-proxy-nxdomain-spikes",
"description": "This report shows NXDOMAIN spikes detected for your shield configuration.",
"businessObjectName": "serviceInstanceId",
"version": 1,
"status": "PUBLISHED",
"deprecated": false,
"timeBased": false,
"supportsPagination": false,
"outputType": "FLAT",
"available": true,
"metrics": [
{
"name": "proxyId",
"description": "The `proxyId` is a GUID identifier for the shield.",
"label": "Proxy ID",
"unit": "STRING",
"summaryStatistic": false
},
{
"name": "proxyName",
"description": "Name of the shield.",
"label": "Proxy Name",
"unit": "STRING",
"summaryStatistic": false
},
{
"name": "serviceInstanceId",
"description": "Unique identification number assigned to a shield configuration.",
"label": "Service Instance ID",
"unit": "STRING",
"summaryStatistic": false
},
{
"name": "startTime",
"description": "Date and time when the NXDOMAIN spike started in ISO-8601 timestamp format with a UTC offset.",
"label": "Start Time",
"unit": "STRING",
"summaryStatistic": false
},
{
"name": "endTime",
"description": "Date and time when the NXDOMAIN spike ended in ISO-8601 timestamp format with a UTC offset.",
"label": "End Time",
"unit": "STRING",
"summaryStatistic": false
},
{
"name": "duration",
"description": "Duration of the NXDOMAIN spike.",
"label": "Duration",
"unit": "STRING",
"summaryStatistic": false
},
{
"name": "totalQueries",
"description": "Total number of queries that were processed by the shield configuration.",
"label": "Total Queries",
"unit": "COUNT",
"summaryStatistic": false
},
{
"name": "totalNxdomains",
"description": "Total number of detected NXDOMAINs.",
"label": "Total NXDOMAIN Responses",
"unit": "COUNT",
"summaryStatistic": false
},
{
"name": "investigateLink",
"description": "Link to the Shield NS53 Proxy Queries report in Control Center.",
"label": "Investigate Link",
"unit": "STRING",
"summaryStatistic": false
},
{
"name": "algo",
"description": "`algo` is either `DYNAMIC` or `ABSOLUTE`. `ABSOLUTE` is shown if NXDOMAIN responses/sec is greater than the threshold value configured in infrastructure security analytics as a spike. `DYNAMIC` is shown if NXDOAMAIN responses/sec is greater than the threshold value (x standard deviations) from the 24 hour moving average that was configured in the app.",
"label": "Algorithm",
"unit": "STRING",
"summaryStatistic": false
},
{
"name": "threshold",
"description": "Threshold for NXDOMAINs that has been reached.",
"label": "Threshold",
"unit": "COUNT",
"summaryStatistic": false
}
],
"groupOutlyingValues": {
"enabled": false
},
"groupBy": [
"proxyId",
"startTime"
],
"intervals": [
"FIVE_MINUTES"
],
"dataRetentionDays": 90,
"links": [
{
"rel": "self",
"href": "/reporting-api/v1/reports/security-analytics-proxy-nxdomain-spikes/versions/1"
},
{
"rel": "versions",
"href": "/reporting-api/v1/reports/security-analytics-proxy-nxdomain-spikes/versions"
},
{
"rel": "all-reports",
"href": "/reporting-api/v1/reports"
},
{
"rel": "execute-report",
"href": "/reporting-api/v1/reports/security-analytics-proxy-nxdomain-spikes/versions/1/report-data"
}
]
}