Contents

Introduction

Prerequisites

Requirements

Components Used

Overview

Understand Domain Trimming

Locations where Domains Show in Full

Introduction

This document describes why you can see domains with a wildcard attached to them in the Top Domains report in Cisco Umbrella.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on Cisco Umbrella.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Overview

Sometimes when viewing your Top Domains report, you can see domains with a wildcard attached to them. Some of the most common examples of this include domains such as:

- *.dyndns.org

- *.amazonaws.com

- *.l.google.com

Understand Domain Trimming

Cisco Umbrella uses a Domain Trimming feature in the Top Domains report, as well as in Scheduled Reports. This feature takes a group of subdomains and groups them together as a singular domain with a wild card attached to it. If Umbrella did not do this, the Top Domains reports can be littered with these sub domains and would not have as much valuable information.

To provide an example of this, these domains can count towards the count of *.l.google.com:

- play.l.google.com

- www-google-analytics.l.google.com

- plus.l.google.com

- gas.l.google.com

- sandbox.l.google.com

- mobile.l.google.com

Locations where Domains Show in Full

The only locations that these domains show as having wildcards is in the Scheduled Reports and in the Top Domains reports. Everywhere else, they show with their full domain names.