Cisco Secure Access Help

PDF

Cisco Secure Access Help

Security Activity Report

Updated: September 15, 2026

Want to summarize with AI?

Log in

Describes Security Activity Report in Cisco Secure Access. The Security Activity report highlights security events generated by your organization's sources visiting destinations flagged—but not necessarily blocked—by Secure Access security researchers as a threat.

The Security Activity report highlights security events generated by your organization's sources visiting destinations flagged—but not necessarily blocked—by Secure Access security researchers as a threat. Activities captured by this report include attempts to access sites hosting malware or phishing sites, botnet activity on infected machines on your local network, and attempts to download malicious files.

View Activity and Details by Filters

The Security Activity report gives you the ability to monitor and discover threats to your organization by displaying traffic patterns. You can filter these results by event type, category, time period, and type of request.

The Security Activity report shows security activity over time and matching events in a table. Use Search Security Activity, Event type, Response, and Filters above the chart to refine the results.

Note
Secure Access reports are time-dependent. Secure Access time is UTC by default but can be changed to a different timezone on a per-user basis. Navigate to Admin > Accounts and update your account's time setting.

Procedure

Before you begin

A minimum user role of Read-only. For more information, see Manage Accounts.

Procedure

  1. Navigate to Monitor > Reports > Security Activity .

    The Security Activity Home interface.

  2. Use the time-range drop-down beside Security Activity to choose a time period of events to view. You can generate a report to document activities for a specific time period. You can select from the predefined ranges for the last 24 hours, the previous calendar day (yesterday), the last seven days, and the last 30 days.


    The Security Activity Date Filter interface.

    To choose a custom time period:

    1. Click Custom range.

      The Security Activity Date Filter Custom interface.
    2. Use the date-time fields beside the report title to set the start and end dates and times.
      The system allows you to choose a maximum of 31 days time period from the last 90 days.
    3. Click OK in the date-time picker to confirm your selection.

  3. Choose which security event types or categories you want to view in the report. By default, all events and categories are selected to display activity for all event types.

    • Antivirus Disposition is Malicious—Lists events that have been filtered through a virus scan.

    • Cisco AMP Disposition is Malicious—Lists events that have been filtered through Cisco Advanced Malware Protection (AMP).

    • Security Category—Lists events allowed or blocked against selected security categories: Command and Control, Cryptomining, Malware, Phishing, and Other Categories (Contains Dynamic DNS, Newly Seen Domains, and Potentially Harmful).


    The Event Type interface.

  4. For Response, select Allowed, Blocked, or both.

    Note
    If you select Antivirus Disposition is Malicious or Cisco AMP Disposition is Malicious as the Event Type, you cannot select Response > Allowed. Secure Access cannot allow viruses to pass through the system. These will always be blocked.
    The Sec Act Response Filter interface.

What to do next

The chart and event table update to reflect the selected time range and filters. The table below the chart lists Event Type, Response, Destination, Identity, and Date & Time for the matching events.

The Security Activity 30 Days interface.

Hover over a bar to view the security activity count for that hour or day. Click the bar to open the Events page for the selected time period and applicable report filters.

View Activity and Details by Event Type or Security Category

To compare activity for individual event types or security categories, click Filters. Under Display, use Group by event type and Group security categories, then click Apply.

Procedure

Before you begin

A minimum user role of Read-only. For more information, see Manage Accounts.

Procedure

  1. Navigate to Monitor > Reports > Security Activity.


    The Security Activity interface.

  2. Choose the time range beside Security Activity: Last 24 hours, Yesterday, Last 7 days, Last 30 days, or Custom range.


    The Time Period interface.

  3. For Event type, select Filters > > Display > Group by event type and Group security categories as needed, then click Apply.

    In


    The Group Events interface.

  4. For Response, select Allowed, Blocked, or both.

    Note
    If you select Antivirus Disposition is Malicious or Cisco AMP Disposition is Malicious as the Event Type, you cannot select Response > Allowed. Secure Access cannot allow viruses to pass through the system. These will always be blocked.

    AMP Disposition is Malicious as the Event Type, you cannot select Response Allowed. Secure Access cannot allow viruses to pass through the system. These will always be blocked.

What to do next

The activity graph updates to show each selected event type so you can compare activities for each type of security risk. You can click the event type on the graph or in the filter to view or hide the events in the graph.


The Sec Act Category Graph interface.

Use Group by event type to compare the selected event types. Use the legend to show or hide a plotted type. To change the report selection, use Event type in Filters and click Apply.


The Sec Act Category Shuffle interface.

Group Security Categories

Click Filters and uncheck Group security categories under Display to display the selected security categories individually in the activity chart, so that you can compare activity and spikes by category. Click Apply to update the report. Use the chart legend to show or hide a plotted category.


The Sec Act Graph Categories 2 interface.

Hover over the chart to inspect the security activity for the selected time and categories. Click a bar to open the Events page for that time period and applicable report filters.


The Sec Act Category Details interface.

View an Event's Details

In the Security Activity report, you can view the details of a security event, including date and time, destination, identity, and the event's result (Blocked or Allowed).

Procedure

Before you begin

A minimum user role of Read-only. For more information, see Manage Accounts.

Procedure

  1. Navigate to Monitor > Reports > Security Activity.


    The Security Activity interface.

  2. Choose the time range beside Security Activity: Last 24 hours, Yesterday, Last 7 days, Last 30 days, or Custom range.


    The Time Period interface.

  3. Use Event type above the chart to select the event types to include.

    For security categories or additional options, click Filters, make your selections, and click Apply.


    The Event Type interface.

  4. For Response select Allowed, Blocked, or both.

    Note
    If you select Antivirus Disposition is Malicious or Cisco AMP Disposition is Malicious as the Event Type, you cannot select Response > Allowed. Secure Access cannot allow viruses to pass through the system. These will always be blocked.

    AMP Disposition is Malicious as the Event Type, you cannot select Response Allowed. Secure Access cannot allow viruses to pass through the system. These will always be blocked.

    The events are displayed in a table below the activity chart.


    The Sec Act Details interface.

  5. Click an event to view its details.

    Review Event Type, Response, Destination, Identity, and Date & Time in each row. Use the destination or identity links to open the corresponding Destination Details or Identity Details.

    Note

    The available event details vary by event type.

Search for Security Activity

To view security activities for a specific source, use the search feature to filter the Activity chart and event details by source.

Prerequisites

  • A minimum user role of Read-only. For more information, see Manage Accounts.

Procedure

Before you begin

A minimum user role of Read-only. For more information, see Manage Accounts.

Procedure

  1. Navigate to Monitor > Reports > Security Activity.

  2. Enter the source name in Search Security Activity and press Enter.

    You can filter by one source at a time.


    The Sec Act Search Identities interface.

To search security activities by more specific fields other than the source, such as domain, URL, or threat type, use the Advanced Search feature.

Procedure

  1. Click Filters above the chart.


    The Click Advanced interface.

    In the right-side panel, find the Advanced fields.

  2. Enter the relevant Domain, URL, SHA256, Threat Name, or Threat Type criteria, and click Apply.

    Use Search Security Activity above the chart for the source or identity search. To reset the panel, click Clear filters; to close it without applying changes, click Cancel.


    The Sec Act Advanced Search interface.