[DNSFilter] Query rate (queries per second) over a time window — the load view, as opposed to the raw counts total_requests returns. Set showIndividualNetworks to break it out per network. Returns raw DNSFilter JSON.

[DNSFilter] Roaming client agents actively sending DNS queries in the window, with their query rate. Use it to confirm which machines are reporting in. Returns raw DNSFilter JSON.

[DNSFilter] Collections actively sending DNS queries in the window, with their query rate. Returns raw DNSFilter JSON.

[DNSFilter] Organizations actively sending DNS queries in the window, with their query rate. Use it to see which clients are actually live. Returns raw DNSFilter JSON.

[DNSFilter] Users actively sending DNS queries in the window, with their query rate. Returns raw DNSFilter JSON.

[DNSFilter] Search the raw DNS query log — every individual lookup, with the domain asked for and whether it was allowed or blocked. This is the investigation tool: use it to answer what a specific machine resolved before it got infected, or what a user was reaching at a particular time. Narrow it with a time window plus any combination of domain, category, network, agent or user filters, then page through the results. Returns raw DNSFilter JSON.

[DNSFilter] The busiest roaming client agents in the window, ranked by request volume. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] The most-used application categories in the window, ranked. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] The most-requested content categories in the window, ranked. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] The busiest collections in the window, ranked by request volume. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] The most-requested domains in the window, ranked. The report to reach for when asked what a network or machine has been visiting. Narrow with domain, fqdn or categoryIds. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] The busiest networks in the window, ranked by request volume. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] The busiest organizations in the window, ranked by request volume. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] Organizations ranked by request count within a single parent organization's scope. Takes a singular organizationId rather than the plural filter the other reports use. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] The busiest users in the window, ranked by request volume. Paginated. Returns raw DNSFilter JSON.

[DNSFilter] Application usage statistics over a time window, attributed to roaming client agents. Returns raw DNSFilter JSON.

[DNSFilter] Application usage statistics over a time window, attributed to collections. Returns raw DNSFilter JSON.

[DNSFilter] Application usage statistics over a time window, attributed to networks. Returns raw DNSFilter JSON.

[DNSFilter] Application usage statistics over a time window, attributed to organizations. Returns raw DNSFilter JSON.

[DNSFilter] Application usage statistics over a time window — which SaaS and web applications are being reached. Returns raw DNSFilter JSON.

[DNSFilter] Application usage statistics over a time window, attributed to users. Returns raw DNSFilter JSON.

[DNSFilter] DNS traffic broken down by content category over a time window — what people are browsing, grouped the way the filtering policy groups it. Set showIndividualNetworks to break it out per network. Returns raw DNSFilter JSON.

[DNSFilter] Content-category traffic over a time window, attributed to roaming client agents. Set showIndividualAgents for one series per agent. Returns raw DNSFilter JSON.

[DNSFilter] Content-category traffic over a time window, attributed to collections. Set showIndividualCollections for one series per collection. Returns raw DNSFilter JSON.

[DNSFilter] Content-category traffic over a time window, attributed to organizations. Set showIndividualOrganizations for one series per organization. Returns raw DNSFilter JSON.

[DNSFilter] Content-category traffic over a time window, attributed to users. Set showIndividualUsers for one series per user. Returns raw DNSFilter JSON.

[DNSFilter] Summary statistics for content categories over a time window. Returns raw DNSFilter JSON.

[DNSFilter] Summary client statistics over a time window. Returns raw DNSFilter JSON.

[DNSFilter] DNS traffic broken down by collection over a time window. Set showIndividualNetworks to break it out per network. Returns raw DNSFilter JSON.

[DNSFilter] Collection traffic over a time window, attributed to roaming client agents. Set showIndividualAgents for one series per agent. Returns raw DNSFilter JSON.

[DNSFilter] Collection traffic over a time window, attributed to organizations. Set showIndividualOrganizations for one series per organization. Returns raw DNSFilter JSON.

[DNSFilter] Collection traffic over a time window, attributed to users. Set showIndividualUsers for one series per user. Returns raw DNSFilter JSON.

[DNSFilter] Current deployment count for an organization. A point-in-time count, so it takes no time window. Returns raw DNSFilter JSON.

[DNSFilter] Request totals for one domain over a time window. Unlike the domain statistics report this takes no fqdn filter. Returns raw DNSFilter JSON.

[DNSFilter] Summary statistics for one domain over a time window. Returns raw DNSFilter JSON.

[DNSFilter] DNS traffic broken down by domain over a time window. Narrow it with the domain or categoryIds filters. Set showIndividualNetworks to break it out per network. Returns raw DNSFilter JSON.

[DNSFilter] Domain traffic over a time window, attributed to collections. Set showIndividualCollections for one series per collection. Returns raw DNSFilter JSON.

[DNSFilter] Domain traffic over a time window, attributed to organizations. Set showIndividualOrganizations for one series per organization. Returns raw DNSFilter JSON.

[DNSFilter] Domain traffic over a time window, attributed to users. Set showIndividualUsers for one series per user. Returns raw DNSFilter JSON.

[DNSFilter] Request totals for organizations within a parent organization's scope. The one report that takes BOTH the singular organizationId scope and the plural organizationIds filter. Returns raw DNSFilter JSON.

[DNSFilter] Summary statistics for a single organization over a time window. Returns raw DNSFilter JSON.

[DNSFilter] Total DNS requests over a time window, returned as a time series for charting. The headline volume report — use it to see overall query load and how it moves. Set showIndividualNetworks to break the series out per network. Returns raw DNSFilter JSON.

[DNSFilter] Total DNS requests over a time window, attributed to roaming client agents. Set showIndividualAgents to return one series per agent rather than a combined total. Returns raw DNSFilter JSON.

[DNSFilter] Total DNS requests over a time window, attributed to collections. Set showIndividualCollections to return one series per collection rather than a combined total. Returns raw DNSFilter JSON.

[DNSFilter] DNS request volume broken down by geography, for the requested number of top locations. Unlike every other traffic report this one REQUIRES a limit. Returns raw DNSFilter JSON.

[DNSFilter] Total DNS requests over a time window, attributed to organizations. Set showIndividualOrganizations to return one series per organization rather than a combined total. Returns raw DNSFilter JSON.

[DNSFilter] Total DNS requests over a time window, attributed to users. Set showIndividualUsers to return one series per user rather than a combined total. Returns raw DNSFilter JSON.

[DNSFilter] Current roaming client count for an organization. A point-in-time count, so it takes neither a time window nor a network filter. Returns raw DNSFilter JSON.

[DNSFilter] Total threat lookups blocked over a time window, as a time series. Use it to show security value and spot an infection spike. This report is already scoped to security traffic, so it takes no securityReport flag. Set showIndividualNetworks to break it out per network. Returns raw DNSFilter JSON.

[DNSFilter] Threat lookups blocked over a time window, attributed to roaming client agents — use it to find the specific machines generating threat traffic. Set showIndividualAgents for one series per agent. Returns raw DNSFilter JSON.

[DNSFilter] Threat lookups blocked over a time window, attributed to collections. Set showIndividualCollections for one series per collection. Returns raw DNSFilter JSON.

[DNSFilter] Threat lookups blocked over a time window, attributed to organizations — the report that answers which client is most at risk. Set showIndividualOrganizations for one series per organization. Returns raw DNSFilter JSON.

[DNSFilter] Threat lookups blocked over a time window, attributed to users. Set showIndividualUsers for one series per user. Returns raw DNSFilter JSON.

[DNSFilter] Mint a new DNSFilter API key. Body (fieldsJson) is a JSON object; fields: name (label for the key), expiry (when it stops working). Not destructive — it only adds a credential and changes nothing that already exists. The response carries the token value, and this is the ONLY time DNSFilter returns it: afterwards only the last four characters are readable. Returns raw DNSFilter JSON.

[DNSFilter] Permanently delete a DNSFilter API key by ID (from dnsfilter_list_api_keys). Destructive and irreversible — the key stops authenticating immediately and its token value cannot be recovered or recreated. Anything built on that key breaks, INCLUDING this StackJack connection if the id belongs to the key StackJack authenticates with. Confirm which key you are removing with dnsfilter_get_api_key first. Returns raw DNSFilter JSON.

[DNSFilter] Get one DNSFilter API key by ID (from dnsfilter_list_api_keys). Returns the key's metadata — name, expiry, last four characters, scope — never the token value, which DNSFilter shows only once at creation. Returns raw DNSFilter JSON.

[DNSFilter] List the DNSFilter API keys belonging to the account this connection authenticates as. Scoped to the token's OWN user, not the whole organization — an empty result does not prove the organization has no keys. Filter by name, by the last four characters of the token, by expiry state or by organization. Token values are never returned, only metadata. Returns raw DNSFilter JSON.