Guide: CAN & Kognitive Cloud Reports
CAN Reports
- The CAN reports are automatically created at regular intervals and shared with Distribution Partners (DPs) through secure SAS tokens. 
- Please refer the following page for information on How To: Access CAN Reports. 
- Storage & Folder Structure - Reports are organized DP-wise - one file with all users and sites. - e.g. DP/DP-00xx/CAN/session/2024/07/11/Session_Report_2025_09_29_000000.csv.gz 
 
Report Fields
The CAN Session report includes specific columns as explained below:
- Organization 
- Site Name 
- Username 
- Email ID 
- Is User Logged In 
- Plan Name 
- Policy Name 
- Plan Start Date 
- IP Address 
- MAC Address 
- Host Name 
- Quota Used (in bytes) 
- Login Date 
- Logout Date 
- Last Activity At 
- Logout Cause 
Kognitive Cloud Reports
- The Kognitive Cloud reports are automatically created at regular intervals and shared with Distribution Partners (DPs) through secure SAS tokens. 
- Please refer the following page for information on How To: Access Kognitive Cloud Reports. 
- Storage & Folder Structure - Reports are organized by DP ID → Report Type (site/activity) → Subtype (vessel/quota/etc.) → Date. - All Kognitice Cloud reports are stored in the following hierarchy: - reports/ 
 └── DP/
 └── DP-00xx/ ← DP ID
 └── site/ ← Report type (site/activity)
 └── vessel/ ← Report subtype
 └── year=2025/
 └── month=06/
 └── day=03/
 └── Site_vessel_2025_06_03_014133.csv.gz
 
Types of Reports
- The following six types of Kognitive Cloud Reports are created - Site – Vessel 
 Site dashboard data including usage distribution, WAN type usage, top apps, and internet status.
- Site – Quota 
 Quota usage per site (percentage used, max quota, estimated over-date).
- Site – Location 
 Hourly snapshot of site location (longitude, latitude, source).
 Sources include VSAT, LTE, Starlink, Manual and other sources like marine traffic.
- Activity – Application 
 Application-wise usage (download, upload, blocked).
- Activity – Users 
 User-wise usage including hostname, IP, MAC, device, VLAN, usage totals, top apps, and risk score.
- Activity – Domain 
 Domain-wise usage (download/upload volume, blocked hits).
 
Report Fields
Each report type includes specific columns as explained below:
Site – Vessel
- sitename (String) → Site name 
- organization (String) → Organization of the site 
- location (String) → City, country (calculated every 8 hrs) 
- upload_usage / download_usage / total_usage (Integer) → WAN usage in bytes 
- top_apps (String) → top 3 application used by site between start_time and end_time 
- internet_status (String) → Llast 15 minutes internet status of site (possible values- Online/Offline/Unknown) 
- start_time, end_time (Datetime) → Time range 
- WAN breakdown: LTE, L-Band, Starlink, Wi-Fi, Wired, VSAT (multiple subtypes) 
Site – Quota
- site_name (String) → Site name 
- current_usage_percentage (Float) → % of quota used 
- current_usage (Integer) → current usage in current quota in bytes 
- usage_source (String) → source of usage data for quota calculation 
- source_links_name (String) → All source type links names over which quota is set 
- quotas (String) → all quota threshold percentage for this quota in ascending order 
- quota_max (Integer) → total maximum quota values in bytes 
- status (String) → current status of quota based on usage 
- current_quota_start_time (Datetime) → current quota start time 
- current_period (String) → total duation completed/total quota duration ,D for days,M for months 
- estimated_over_date (String) → Calculated date when quota is exceeded 
- query_time (Datetime) → time when this data is generated 
Site – Location
- site_name (String) → Site name 
- location_id (String) → internal system site id 
- longitude, latitude (Float) → Location coordinates 
- source (String) → Location source (VSAT, LTE, Starlink, etc.) 
- location_time, start_time, end_time (Datetime) → Timestamps 
The different location sources are -
VSAT - Data collected by VSAT controller in edge device
LTE - Data collected by LTE controller in edge device
Starlink - this data is collected by starlink telemetry. Its precision is h3 index level which is basically corresponds to 252.903858182 km2 hexagon size in map.
Manual - This data is entered by user. Either street address or either hard coded latitude and longitude in sports topology page (site name edit option).
Marine Traffic
Activity – Application
- dataType (String) → Download/Upload/Blocked 
- usageFrom (String) → Application name 
- usageTotal (Integer) → Usage in bytes or blocked hits 
- start_time (Datetime) → start time of this data calculation 
- end_time (Datetime) → end time of this data calculation 
Activity – Users
- hostname, ipAddress, macAddress (String) → User identifiers 
- device, vlan, site (String) → Connection details 
- total, upload, download (Integer) → Usage in bytes 
- topApps (String) → Top 3 applications 
- top_risk (Float) → Max risk score 
- captiveDeviceName (String) → Last captive user name 
- start_time (Datetime) → start time of this data calculation 
- end_time (Datetime) → end time of this data calculation 
Activity – Domain
- dataType (String) → Download/Upload/Blocked 
- usageFrom (String) → Domain name 
- usageTotal (Integer) → Usage in bytes or blocked hits 
- start_time (Datetime) → start time of this data calculation 
- end_time (Datetime) → end time of this data calculation