@ataudte recommend configuring the policies to take advantage of the new suspicious rpzs.. there three of them.. and you'll have and even more interesting display. Their topn is limited by definition to their customers and popular domains they're seeing in a wide range of networks but that's pretty nice way to get a sample of things that are broadly seen.