zins_get_web_traffic_by_location( start_days_ago=9, end_days_ago=2, traffic_unit="TRANSACTIONS", limit=20)```text
This identifies which offices, branches, or regions generate the most web traffic. Look for:
- Top traffic-generating locations (potential bandwidth bottlenecks)- Unusual traffic spikes at specific locations- Remote vs office traffic distribution
**With trend data for capacity planning:**
```textzins_get_web_traffic_by_location( start_days_ago=9, end_days_ago=2, traffic_unit="BYTES", include_trend=True, trend_interval="DAY", limit=10)```text
---
### Step 3: Analyze Protocol Distribution
**Get protocol breakdown:**
```textzins_get_web_protocols( start_days_ago=9, end_days_ago=2, traffic_unit="TRANSACTIONS", limit=20)```text
Evaluate:
- **HTTPS adoption**: What percentage of traffic is encrypted?- **HTTP traffic**: Remaining unencrypted traffic may indicate legacy applications or misconfigured services- **Other protocols**: SSL, FTP over HTTP, WebSocket, etc.- **Anomalies**: Unexpected protocol usage may indicate malware or policy bypass
---
### Step 4: Analyze Overall Traffic Volume and DLP
**Get total traffic volume (no grouping):**
```textzins_get_web_traffic_no_grouping( start_days_ago=9, end_days_ago=2, traffic_unit="TRANSACTIONS")```text
**Filter by DLP violations:**
```textzins_get_web_traffic_no_grouping( start_days_ago=9, end_days_ago=2, dlp_engine_filter="PCI", traffic_unit="TRANSACTIONS")```text
Available DLP engine filters:
- `ANY` -- any DLP engine triggered- `NONE` -- no DLP engine triggered- `HIPAA` -- healthcare data violations- `PCI` -- payment card data violations- `GLBA` -- financial data violations- `CYBER_BULLY_ENG` -- cyberbullying content- `OFFENSIVE_LANGUAGE` -- offensive content- `EXTERNAL` -- external DLP engine
**Filter by action:**
```textzins_get_web_traffic_no_grouping( start_days_ago=9, end_days_ago=2, action_filter="BLOCK", traffic_unit="TRANSACTIONS")```text
**Get volume trends over time:**
```textzins_get_web_traffic_no_grouping( start_days_ago=9, end_days_ago=2, include_trend=True, trend_interval="DAY", traffic_unit="BYTES")```text
---
### Step 5: Check Threat Activity in Web Traffic
**Get threat super categories:**
```textzins_get_threat_super_categories( start_days_ago=9, end_days_ago=2, traffic_unit="TRANSACTIONS", limit=20)```text
This shows high-level threat categories (malware, phishing, spyware, C2, etc.) detected in web traffic.
**Get detailed threat classifications:**
```textzins_get_threat_class( start_days_ago=9, end_days_ago=2, traffic_unit="TRANSACTIONS", limit=20)```text
This breaks threats into specific types (virus, trojan, ransomware, exploit kit, cryptominer, etc.).
---
### Present Analysis
```textWeb Traffic Analysis Report=============================Date: <current_date>Period: <start_date> to <end_date> (7-day / 14-day interval)
## Traffic Summary
- **Total Transactions:** X,XXX,XXX- **Total Data Volume:** XX.X GB- **Blocked Transactions:** X,XXX (X.X% of total)- **DLP Violations:** X,XXX
---
## Traffic by Location (Top 10)
| Rank | Location | Transactions | % of Total | Trend ||------|---------------------|-------------|-----------|------------|| 1 | New York HQ | 450,000 | 32% | Stable || 2 | San Francisco | 280,000 | 20% | ↑ 15% || 3 | London | 195,000 | 14% | Stable || ... | ... | ... | ... | ... |
---
## Protocol Distribution
| Protocol | Transactions | % of Total | Assessment ||----------|-------------|-----------|-------------------|| HTTPS | 1,200,000 | 87% | Good adoption || HTTP | 140,000 | 10% | Review needed || SSL | 35,000 | 2.5% | Normal || Other | 7,000 | 0.5% | Monitor |
HTTPS adoption at 87% -- target is 95%+. HTTP traffic sourcesshould be investigated for possible migration to HTTPS.
---
## Threat Detections
| Category | Count | Trend vs Previous ||-----------------|--------|-------------------|| Malware | 2,340 | ↑ 12% || Phishing | 1,890 | ↓ 5% || Spyware | 890 | Stable || Adware | 567 | ↓ 20% |
---
## DLP Summary
| DLP Engine | Violations | Action ||-----------|-----------|---------|| PCI | 145 | Blocked || HIPAA | 89 | Blocked || GLBA | 23 | Blocked |
---
## Recommendations
1. Investigate HTTP traffic sources for HTTPS migration2. Review the 12% increase in malware detections3. <location> shows unusual traffic spike -- verify with local IT4. PCI violations trending up -- review DLP policy exceptions```text
---
## Edge Cases
### No Data Returned
```textZ-Insights returned no data for the specified time range.
Possible causes:- Z-Insights/Business Insights may not be licensed for this tenant- The time range may be outside the supported window- Data has a 24-48 hour processing delay
Action: Verify Z-Insights licensing and try a time range endingat least 2 days ago.```text
### Time Range Errors
```textThe Z-Insights API requires time intervals of exactly 7 or 14 days.
Use these parameter combinations:- 7-day: start_days_ago=9, end_days_ago=2- 14-day: start_days_ago=16, end_days_ago=2
The tool auto-adjusts intervals when using days_ago parameters.```text
---
## Quick Reference
**Primary workflow:** Scope → Locations → Protocols → Volume/DLP → Threats → Report
**Traffic tools:**
- `zins_get_web_traffic_by_location()` -- traffic distribution by location- `zins_get_web_traffic_no_grouping()` -- overall traffic volume with DLP and action filters- `zins_get_web_protocols()` -- protocol distribution (HTTP, HTTPS, SSL, etc.)
**Threat tools:**
- `zins_get_threat_super_categories()` -- high-level threat categories- `zins_get_threat_class()` -- detailed threat classifications
**Common parameters:**
- `start_days_ago` / `end_days_ago` -- recommended time range specification- `traffic_unit` -- TRANSACTIONS (request counts) or BYTES (data volume)- `include_trend` / `trend_interval` -- enable time series data (DAY or HOUR)- `dlp_engine_filter` -- filter by DLP engine (PCI, HIPAA, GLBA, etc.)- `action_filter` -- filter by action (ALLOW, BLOCK)- `limit` -- max results (1-1000)
