A status dashboard contains widgets from which you can view and manage data. Widgets are the building blocks of status dashboards. For more information about widgets, see Adding Widgets to Dashboards below. They provide information about different aspects of your Grid and networks. For example, the Member Status widget provides general information about a Grid member, and the Network Statistics widget provides data for a specified network.

The appliance provides a default status dashboard. Grid Manager displays the default dashboard only when there is more than one widget on the dashboard. You can add and modify widgets in the default dashboard, but you cannot rename or delete it. From a dashboard, you can access your most commonly accessed tasks and monitor appliance status. You can configure your own status dashboards to which you can add widgets that help you manage different data. Configuring multiple status dashboards helps organize widgets in a meaningful way and improves dashboard and widget performance. This is especially useful when you have a Grid serving a large number of Grid members. When you configure a new dashboard, you can use the existing dashboard as a template. You can create up to 100 copies at a time using the Add Dashboard option. For information about how to add status dashboards, see Adding Status Dashboards below.

You can add widgets to different dashboards, however, you can add only one widget at a time on each dashboard. The default number of widgets per dashboard is 10. The maximum number of widgets that you can add on each dashboard is 20 at a time. You can define the number of widgets that can be configured on each dashboard in User Profile. This limitation applies only to dashboards that you configure and does not apply to the default dashboard. For information about how to specify the widget limit, see Configuring Widget Limit per Dashboard below.

Grid Manager provides a default Security dashboard if you have installed any or all of the following licenses on the appliance: Threat Protection, RPZ, and Threat Analytics. The Security dashboard contains widgets that help you monitor the security status of the Grid. In the Security dashboard, you can add and remove widgets, but you cannot rename or delete them.

...

1. Default Status Dashboard: From the Dashboards -> Status tab -> Default tab, click the Configure icon -> Add Content. This is applicable when you have the default dashboard only.
   Configured Status Dashboards: From the Dashboards -> Status tab, select the configured status dashboard, click the Configure icon -> Add Content.
   Security Status Dashboard: From the Dashboards -> Status tab -> Security tab, click the Configure icon -> Add Content. This is applicable only when at least one member in the Grid has Threat Protection, RPZ, or Threat Analytics license. Note that the Security Status dashboard is a default dashboard and it cannot be renamed or deleted.
   Grid Manager displays thumbnails of the available widgets. Use the scroll bar on the right to scroll through the widgets, as illustrated in the below Widgets Panel figure.
2. Click an icon on the filter panel, as illustrated in the Widgets Panel figure, to add a widget to the desired dashboard. The Filter panel is categorized into the following:
   Cloud ,
   Security ,
   DNS/DHCP , and
   Reset .
   When you click on an icon, Grid Manager displays thumbnails of the widgets belonging to the respective filter. If you click filters one after the other without clicking Reset, Grid Manager displays thumbnails of all widgets along with the icon that indicates the category to which the widget belongs. Click Reset to view only those widgets that belong to the selected category.

3. Select and drag a widget to the desired location on your dashboard. You can also click  icon to add a widget to the desired dashboard.
   After you add a widget to the dashboard, you can configure it to provide relevant data. You can also copy or move a widget, by selecting and dragging it to its new location on your dashboard. Grid Manager saves your dashboard configuration and displays it the next time you log in.
   You can turn on auto-refresh by clicking On in the Turn Auto Refresh field at the top of the dashboard to periodically refresh the contents of all widgets in the dashboard. Click Off to disable auto-refresh for all widgets in the dashboard. When auto-refresh is disabled, you can enable it for individual widgets by clicking the Configure icon in the corresponding widgets. You can specify the auto-refresh period in seconds. The default auto-refresh period is 30 seconds.

   Warning
   title Warning
   If the Detailed Status panel is open, the following actions take place: Grid Manager auto refreshes at a rate of 30 seconds. Widgets that support user-specified auto refresh, refresh at the rate specified in the Auto Refresh Period field. Therefore, even if you set the session timeout to be to greater than the auto refresh rate, auto refresh still takes place. The Grid Manager session does not time out because auto refresh takes precedence over the session timeout.

   Widgets have the following icons:

...

1. From the Dashboards -> Status tab, click the Configure icon -> Global Dashboard Properties.
2. In the Global Dashboard Properties editor, complete the following:
   • Threat Protection Thresholds: Define the thresholds for each severity level of the threat protection events for the following colors:
     • Yellow: Specify the low threshold value for Critical, Major, and Warning severity level. The default values are 1, 20, and 100 for Critical, Major, and Warning respectively.
     • Red: Specify the high threshold value for Critical, Major, and Warning severity level. The default values are 5, 100, and 1000 for Critical, Major, and Warning respectively.
       
       Depending on the specified thresholds, Grid Manager determines the status of threat protection service as follows, which is displayed in the Status column of the Security Status for Grid widget:
     • Green (OK): When the number of threat protection events are less than the low threshold value specified for the yellow color for all the severity levels.
     • Yellow (Warning): When the number of threat protection events equals or exceeds the threshold value specified for the yellow color but less than the threshold value specified for the red color for any of the severity levels.
     • Red (Critical): When the number of threat protection events equals or exceeds the high threshold value specified for the red color for any of the severity levels.
   • Response Policy Zone Thresholds: Define the threshold values for the following colors to determine the overall status of RPZ:
     • Yellow: Specify the low threshold value for Blocked, Substitute, and Passthru RPZ rules. The default values are 10, 1, and 100 for Blocked, Substitute, and Passthru respectively.
     • Red: Specify the high threshold value for Blocked, Substitute, and Passthru RPZ rules. The default values are 100, 10, and 1000 for Blocked, Substitute, and Passthru respectively.
       
       Depending on the specified thresholds, Grid Manager determines the status of RPZ as follows, which is displayed in the Status column of the Grid Security Status widget:
     • Green (OK): When the number of RPZ hits are less than the low threshold value specified for the yellow color for all the rule types.
     • Yellow (Warning): When the number of RPZ hits equals or exceeds the threshold value specified for the yellow color but less than the threshold value specified for the red color for any of the rule types.
     • Red (Critical): When the number of RPZ hits equals or exceeds the high threshold value specified for the red color for any of the rule types.
   • Threat Analytics Thresholds: Define the thresholds for the following colors, to determine the overall status of DNS Threat Analytics:
     • Yellow: Specify the low threshold value for DNS Tunneling events. The default value is 1.
     • Red: Specify the high threshold value for DNS Tunneling events. The default value is 5.
       
       Depending on the specified thresholds, Grid Manager determines the status of DNS Threat Analytics as follows, which is displayed in the Status column of the Grid Security Status widget:
     • Green(OK): When the number of DNS tunneling attacks are less than the low threshold value specified for the yellow color.
     • Yellow(Warning): When the number of DNS tunneling attacks equals or exceeds the threshold value specified for the yellow color but less than the threshold value specified for the red color.
     • Red(Critical): When the number of DNS tunneling attacks equals or exceeds the high threshold value specified for the red color.

...

1. Save the configuration.

...

• Protocol: Select either IPv4 or IPv6.
• Click Select Member. In the Member Selector dialog box, select a Grid member from the list.
• Graph Configuration: This section lists IPv4 or IPv6 messages, depending on the protocol you selected.
• Select which IPv4 messages you want to track in the Messages per Second graph.
  • Discovers: The number of DHCPDISCOVER messages that the Grid member received from DHCP clients. A DHCP client broadcasts a DHCPDISCOVER message to obtain an IP address.
  • Offers: The number of DHCPOFFER messages that the Grid member sent to DHCP clients. If the Grid member has an IP address that it can allocate to the DHCP client that sent the DHCPDISCOVER message, the Grid member responds with a DHCPOFFER message that includes the IP address and configuration information.
  • Requests: The number of DHCPREQUEST messages that the Grid member received from DHCP clients. A DHCP client sends DHCPREQUEST messages when it selects a lease, connects to the network, and if it renews the lease.
  • Acks: The number of DHCPACK messages that the Grid member sent to DHCP clients. When the Grid member receives a DHCPREQUEST message, it responds with a DHCPACK message to confirm the IP address selected by the DHCP client.
  • Nacks: The number of DHCPNACK messages that the Grid member sent to DHCP clients. The Grid member sends a DHCPNACK message when a DHCP client requests an IP address that is not valid for the network.
  • Declines: The number of DHCPDECLINE messages that the Grid member received. A DHCP client sends a DHCPDECLINE message to a DHCP server when it discovers that the IP address offered by a DHCP server is already in use.
  • Informs: The number of DHCPINFORM messages that the Grid member received. A client that did not receive its IP address from the DHCP server can send it a DHCPINFORM message to retrieve configuration parameters, such as the IP addresses of DNS servers in the network.
  • Releases: The number of DHCPRELEASE messages that the Grid member received. A DHCP client sends a DHCPRELEASE message when it terminates its lease and releases its IP address.
• Select which IPv6 messages you want to track in the Messages per Second graph.
  • Declines: The number of Decline messages that the Grid member received. A DHCP client sends a Decline message to a DHCP server when it discovers that the IP address offered by a DHCP server is already in use.
  • Renews: The number of Renew messages that the Grid member received. A DHCP client sends a Renew message to a DHCP server to extend the lifetimes on the leases granted by the DHCP server and to update other properties.
  • Information Requests: The number of Information-Request messages that the Grid member received. A client sends an Information-Request message to retrieve configuration parameters, such as the IP addresses of DNS servers in the network.
  • Solicits: The number of Solicit messages that the Grid member received, including Solicit messages embedded in Relay-Forward messages. A DHCP client sends a Solicit message to locate DHCP servers.
  • Requests: The number of Request messages that the Grid member received. A DHCP client sends a Request message to request one or more IP addresses and configuration parameters from a DHCP server.
  • Rebinds: The number of Rebind messages that the Grid member received. A DHCP client sends a Rebind message to extend the lifetime of its lease and to update configuration parameters.
  • Releases: The number of Release messages that the Grid member received. A DHCP client sends a Release message when it terminates its lease and releases its IP address.
  • Advertises: The number of Advertise messages that the Grid member sent. When a DHCP server receives a Solicit message, it can respond with an Advertise message to indicate that the server is available for DHCP service.
  • Replies: The number of Reply messages that the Grid member sent. A DHCP server sends a Reply message that includes IP addresses and configuration parameters when it responds to Solicit, Request, Renew or Rebind message. It sends a Reply message with configuration parameters only when it responds to an Information-Request message.

The widget displays the following information:

...

• Click Select Member. In the Member Selector dialog box and select a Grid member from the list.
• CPU: Select which type of CPU usage you want to track:
  • User: The CPU usage of user applications, such as programs and libraries.
  • System: The CPU usage of the kernel and drivers.
  • Idle: The percentage of CPU that is not in use.
• System Memory: Select which portion of the system memory you want to track:
  • Real Memory Used: The physical RAM usage.
  • Swap Used: The swap area usage. The swap area is the disk area that temporarily holds a process memory image.
• NIC Usage: Select how you want to measure network traffic:
  • Bytes: Reports the number of bytes.
  • Packets: Reports the number of packets.

• NIC Settings: Select the port on which you want to measure network traffic. If you have configured VLANs, Grid Manager displays them in the format LAN1 nnnn or LAN2 nnnn, where nnnn represents the associated VLAN ID. For example, a VLAN configured on LAN1 can be displayed as LAN1 297 and a LAN2 VLAN can be LAN2 21. For more information about VLANs, see VLAN Management.

  Note
  title Note
  For vNIOS appliances, some of the options in the drop-down list may vary depending on your vNIOS configuration. For example, if you are using a single network interface instance of vNIOS for GCP, you will see choices specific to the LAN1 interface only. For more information, see the vNIOS documentation specific to your product at Appliances.

  
  

• CPU Utilization and Top N Processes: Set the auto refresh period in this section. NIOS displays the information for all available cores.
  • Auto Refresh Period for CPU Utilization and Top N Processes: Enter the time interval in seconds for the CPU Core Utilization graph and the top N process data to auto refresh and display the CPU core utilization information. If you enter 12, the graph displays new information after every 12 seconds. You can enter a minimum refresh interval of 10 seconds and a maximum refresh interval of 30 seconds. By default, the time interval is set to 10 seconds. This field is applicable only to the CPU Utilization and Top N Processes tabs.
• Auto Refresh Period: Enter the refresh interval in seconds for the data in the CPU, System Memory, and NIC Usage tabs to auto refresh.

The System Activity Monitor widget displays a tab for each resource: CPU, System Memory, NIC Usage, CPU Utilization, Top N Processes.

...

• CPU: The graph on the CPU tab tracks the percentage of CPU usage.
• System Memory: The graph on the System Memory tab tracks the memory utilization percentage.
• NIC Usage: The graph on the NIC Usage tab tracks either bytes or packets per second.
• CPU Utilization: If you select the Live option, the graph tracks live CPU utilization data for the last 10 minutes for all CPUs in your Grid member. The graph is refreshed based on the time interval you specify in the Auto Refresh Period for CPU Utilization and Top N Processes field. Each CPU is denoted in a different color. If you select the Historical option, you can view the CPU utilization data for up to a maximum of past 60 minutes based on the time range you specify in the Earliest and Latest fields. For example, if you enter 2019-09-05 and 09:20:42 AM in the Earliest field and 2019-09-05 and 10:20:42 AM in the Latest field, the graph displays the CPU utilization data for 5th September 2019 between 9:20:42 AM and 10:20:42 AM. You can view data for a maximum of past of 5 days but the time difference between Earliest and Latest time should not exceed 60 minutes.
• Top N Processes: If you select the Live option, the table displays the process ID and name of the top N processes that are consuming CPU utilization. N is the number that you specify in the Number of Top Processes field on the Monitoring tab of the Grid Properties editor. It also displays the percentage of CPU utilized by each process. The data is refreshed based on the time interval you specify in the Auto Refresh Period for CPU Utilization and Top N Processes field. If you select the Historical option, you can view past top N process data based on the time range you specify in the Earliest and Latest fields. For example, if you enter 2019-09-05 and 09:20:42 AM in the Earliest field and 2019-09-05 and 10:20:42 AM in the Latest field, the graph displays the top process data on 5th September 2019 between 9:20:42 AM and 10:20:42 AM. You can view data for a maximum of 5 days.

...

• User Name: The admin user who submitted the CSV import. Only superusers can view this column.
• Status: The current status of the import job. The status can be one of the following:
  • Import successful: The import is completed without errors. Check the Message field for information about the import.
  • Import unsuccessful: The import is completed, but with errors. Check the Message field for information about the error message.
  • Import pending: The job is in queue for execution.
  • Import in progress: The job is being executed.
  • Import stopped: The job has been stopped. You can select the job and restart the import.
  • Test successful: Test is completed without errors. Check the Message field for information about the test.
  • Test unsuccessful: Test is completed, but with errors. Check the Message field for information about the error message.
  • Test pending: Test is in queue for execution.
  • Test in progress: Test is in progress.
  • Test stopped: Test has been stopped. You can select the job and restart the import.
  • Saved file: The data file has been uploaded, but the import has not started.
  note
  • 
    
  title
  • Note
  After
  • that after a product restart, which can be caused by a failover, all Import in progress jobs go into Import stopped state; all Import pending jobs continue to be queued for execution.
  • Submitted: The timestamp when the job was submitted.
  • Completed: The timestamp when the job was completed. This field is blank if the job has not been completed yet.
  • File Name: The CSV data file name.
  • Message: This field displays the number of rows of data that has been processed and the number of rows of data the import has detected errors. Depending on the import options, Grid Manager displays the row number at which it stops the import when it encounters an error, or the total number of rows it has processed by skipping over the erroneous data. For example, if there are 100 rows of data and you select "On error: Stop importing," and there is an error in row 90, the appliance displays 90of100completed,1error. If you select "On error: Skip to the next row and continue," the appliance displays 100 of 100 completed, 1 error.
  • File Size: The CSV data file size.

  
  

...

• Task ID: The ID associated with the task. The appliance assigns an ID to a task in chronological order.
• Submitter: The username of the admin who scheduled or submitted the task.
• Ticket Number: The reference number entered by the submitter to identify the task. You can enter up to 20 alphanumeric characters.
• Scheduled Time: The date, time, and time zone when the task was scheduled for execution.
• Affected Object: The name or value of the object that is associated with the task. For example, if the task involves an A record, this field displays the domain name of the record. If it is a fixed address, it displays the IP address of the fixed address.
• Object Type: The object type. For example, the appliance can display A Record or Fixed Address.
• Action: The operation the appliance performs in this task. The operation can be: Add, Modify, Delete, or Network Discovery.
• Submitte Time: The date, time, and time zone when the task was submitted. You can select this for display. It is not displayed by default.Image Removed

Infoblox Community

...

• MozillaFireFox: Click the Shield icon Image Removed  in icon in the address bar and choose DisableProtectiononThisPage from the drop-down list. The icon in the address bar changes to a warning triangle Image Removedand triangle and content is displayed in the InfobloxCommunity widget. For more details, refer to information at https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/.
• Google Chrome: Click the Shield icon Image Removed in the address bar and click Load unsafe script in the pop-up box. Chrome automatically refreshes the webpage and loads the content in the Infoblox Community widget. For more details, refer to information at https://support.google.com/chrome/answer/1342714?hl=en.
• Internet Explorer: Click the Compatibility View icon Image Removed adjacent icon adjacent to the address bar. The browser refreshes and the Security Warning dialog box is displayed. Click No in the dialog box. The Only Secure content is displayed pop-up blocker is displayed at the bottom of the browser. Click the Show all content button in this pop-up blocker to view the content. For more details, refer to the information at http://windows.microsoft.com/en-in/internet-explorer/use-compatibility-view#ie=ie-8.

...

The DNS Integrity Check widget displays status about DNS data discrepancies that have been detected through DNS integrity check that is designed to mitigate DNS domain hijacking. This widget displays top-level or parent authoritative zones that have been selected for DNS data monitoring. For information about how to configure DNS integrity check to mitigate possible DNS domain hijacking, see Configuring DNS Integrity Check for Authoritative Zones.
The widget displays the following information (note that this table is sorted by Status.):

•  Image Removed : Left  Left click the Action icon Image Removed next icon next to a zone to perform the following:
  Image Added
  • View Syslog: Select this to open the Syslog Preview dialog and view data discrepancy events for the selected zone. 
  • Check Now: Select this to perform DNS integrity check to immediately query current DNS data from the top-level parent domain. When you select this, verbose logging for DNS integrity check is automatically enabled. After the operation is complete, the appliance updates the timestamp for the Last Checked column.
• Zone: Displays the name of the top-level authoritative zones that is being monitored for DNS integrity check. You can click the zone name and the appliance opens the zone viewer for the selected zone.
• Status: Displays the current DNS data discrepancy status. The status can be one of the following:
  • Critical (red): Data in the NS RRsets for the authoritative and delegate zones are completely out of synchronization.
  • Severe (orange): Some data in the NS RRset between the authoritative and delegate zones overlaps and some data is different.
  • Warning (yellow): The NS RRset for the authoritative zone is a subset of the NS RRset for the delegate zone. It is possible that incorrect IP addresses have been entered at the registrar.
  • Informational (blue): The NS RRset for the delegate zone is a subset of the NS RRset for the authoritative zone. This could indicate a possible delay in domain registration.
  • Normal (green): There are no DNS data discrepancies between the NS RRsets for the authoritative and delegated zones.
  • None (black): No DNS discrepancies data has been collected or DNS integrity check has not been performed.
• Last Checked: The timestamp in YYYY-MM-DD HH:MM:SS when the parent domain was last queried for its DNS data.
• Description: Information about the zone.

...

You can also click Go to Syslog Viewer on the upper right corner of the dialog to view all events in the syslog. For more information about the syslog, see Viewing the Syslog.

Cloud Statistics

The Cloud Statistics widget appears only when you have deployed the Cloud Network Automations license on the Grid Master. This widget displays statistical information for cloud objects. It contains the following tabs: Tenant & VMs, Fixed vs. Floating and Available vs. Allocated. You must install valid cloud related licenses to access this widget. For more information about installing licenses and enabling Cloud Network Automation, see Deploying Cloud Network Automation.
To modify the Cloud Statistics widget, click the Configure icon and select one of the following:

...

You can also do the following in this widget:

...

• Click the

  Turn on auto-refresh. Click the Configure icon and select the AutoRefreshPeriod checkbox to turn on auto-refresh. Specify the auto-refresh period in seconds. The default auto refresh period is 30 seconds.

• Click the Action icon (shown as a gear in each row of the table) next to the overall status of each member, and select ViewSyslog to view all the events logged in the syslog. Grid Manager displays the syslog messages in the Syslog Preview window.
• Click the Export icon to export the data displayed in this widget.
• Click the Print icon to print the data displayed in this widget.
• Click Response Policy Zones link in the GoTo field at the top of the widget to view the RPZs configured on the member. Grid Manager displays the Response Policy Zones tab on the DNS tab. To navigate back to the Security dashboard, click Back to Security Dashboard at the top left corner of the navigation bar in the Response Policy Zones tab.
• Click Threat Protection link in the Go To field at the top of the widget to view the threat protection rulesets configured on the member. Grid Manager displays the Threat Protection Rules tab on the Security tab. To navigate back to the Security dashboard, click Back to Security Dashboard at the top left corner of the navigation bar on the Threat Protection Rules tab.
• Click Threat Analytics link in the Go To field at the top of the widget to view the whitelist domains configured on the member. Grid Manager displays the Threat Analytics tab. To navigate back to the Security dashboard, click Back to Security Dashboard at the top right corner of the panel on the Threat Analytics tab.
• Click Members link in the Go To field at the top of the widget to view the members configured in the Grid. Grid Manager displays the Members tab on the Grid Manager tab. To navigate back to the Security dashboard, click Back to Security Dashboard at the top left corner of the navigation bar on the Members tab.

...

The Threat Protection Status for Grid widget displays the statistical information about the threat protection events triggered on all the members in the Grid that support Infoblox Advanced DNS Protection, hardware or Software ADP, and Infoblox Threat Insight. This widget contains the following tabs: Total Events by Severity, Top 10 Grid Members, Events Over Time, Top 10 Rules, and Top 10 Clients.
You can do the following in this widget:

...

...

• Turn on auto-refresh.
  Click the Configure icon, select the Auto Refresh Period checkbox, and specify the refresh period in seconds. The default auto refresh period is 30 seconds. You can click the Configure icon again to hide the configuration panel.

• Click the Total Events by Severity tab to view information about threat protection related events by the severity level. 
• Click the Top 10 Grid Members tab to view information about the top 10 Grid members that have the most number of threat protection events. 
• Click the Events Over Time tab to view information about the total event count for each type of event severity in the given time frame. 
• Click the Top 10 Rules tab to view information about the top 10 threat protection rules with the most number of hits.
• Click the Top 10 Clients tab to view information about the top 10 clients that have the most number of threat protections events.

...

• Click Select Member. In the Member Selector dialog box, select a Grid member from the list that supports Infoblox Advanced DNS Protection, hardware or Software ADP.
• Select either Dial or Bar as the display format for the following resources: Smart NIC CPU, Traffic being dropped, Traffic being received. Note that Smart NIC CPU selection is displayed only when you select a Grid member that supports Infoblox Advanced DNS Protection.
• SNIC Settings: Select the interface for which you want to view the interface usage information. You can select one of the following from the drop-down list: HA, LAN1, or LAN2. You can view the interface usage information for the selected interface in the Interface Usage tab. This is displayed only when you select a Grid member that supports Infoblox Advanced DNS Protection.
  Note that you can select the HA port even though the Grid member is not an HA pair, because the HA port on a single member can be exposed to potential attacks.
• NIC Settings: Select the interface for which you want to view the interface usage information. You can select one of the following from the drop-down list: HA, LAN1, or LAN2. You can view the interface usage information for the selected interface in the Interface Usage (LAN1) tab. This is displayed only when you select a Grid member that supports Software ADP.
• Events Over Time: Select the severity level, Critical, Major, Warning, or Informational, to view the details for a specific severity level. You can select one or all the available severity levels.

• Select the AutoRefresh Auto Refresh Period checkbox to turn on auto-refresh, and specify the auto-refresh period in seconds. The default is 30 seconds.

Click the Configure icon again to hide the configuration panel after you complete the modification. You can do the following in this widget:

...

The Health tab displays information of RPZ zones and their last updated date and time. This data is retrieved directly from the database. Note that you cannot sort or filter values on this tab. You can export the data displayed on this tab by clicking the Export icon. For more information, see Exporting Displayed Data.

Response Policy Zone (RPZ) Status for Member

...

• Client Hits: Total number of queries that triggered an RPZ policy. Note that this option is not displayed when you choose Stacked Diagram, but displayed only when you choose Line Diagram.
• Passthru Hits: Total number of queries that triggered a Passthru RPZ rule. For more information about passthru rules, see Managing Passthru Rules.
• Blocked Hits: Total number of queries that triggered a Block (No Data) or Block (No Such Domain) RPZ rule. For more information, see Managing Block (No Data) Rules or Managing Block (No Such Domain) Rules respectively.
• Substituted Hits: Total number of queries that triggered a Substitute (Domain Name) or Substitute (Record) RPZ rule. For more information, see Managing Substitute (Domain Name) Rules and Managing Substitute (Record) Rules.
• Timestamp: The graph displays a 24 hours time window.
  Note the following about this tab:
• The statistical data in DNS service will be reset when you stop and restart the DNS service or if you force an active DNS service to restart regardless of its state. This results in loss of prior data.
• Using this graph, you can view the timestamp of statistics collection.

...

The Threat Analytics Status for Grid widget displays the statistical information about the DNS tunneling events. This widget contains the following tabs: Detections Over Time, Top 10 Grid Members, and Detections.
You can do the following in this widget:

Turn on auto-refresh.
Click the Configure icon, select the AutoRefreshPeriod checkbox, and specify the refresh period in seconds. The default auto refresh period is 30 seconds. Click the Configure icon again to hide the configuration panel after you complete the modification.

...

• Turn on auto-refresh.
  Click the Configure icon, select the AutoRefreshPeriod checkbox, and specify the refresh period in seconds. The default auto refresh period is 30 seconds. Click the Configure icon again to hide the configuration panel after you complete the modification.

• Click the Detections Over Time tab to view information about the detected DNS tunneling events in a given time frame.
• Click the Top 10 Grid Members tab to view information about the top 10 Grid members with the most total counts of detections by type.
• Click the Detections tab to view information about all the detected DNS tunneling events.

...

The Threat Analytics Status for Member widget displays statistics about the DNS tunneling events for a specific Grid member.
To configure the Threat Analytics Status for Member widget, click the Configure icon and complete the following:

...

Select the AutoRefreshPeriod checkbox to turn on auto-refresh, and specify the auto-refresh period in seconds. The default is 30 seconds.

• Click Select Member to select a Grid member. If there are multiple members, the MemberSelector dialog box is displayed, from which you can select a member. Click the required member name in the dialog box. You can also click Clear to clear the displayed member and select a new one.

• Select the Auto Refresh Period checkbox to turn on auto-refresh, and specify the auto-refresh period in seconds. The default is 30 seconds.

Click the Configure icon again to hide the configuration panel after you complete the modification.

...