Guide: CAN & Kognitive Cloud Reports

CAN Reports

• The CAN reports are automatically created at regular intervals and shared with Distribution Partners (DPs) through secure SAS tokens.

• Please refer the following page for information on How To: Access CAN Reports.

• Storage & Folder Structure - Reports are organized DP-wise - one file with all users and sites.

  • e.g. DP/DP-00xx/CAN/session/2024/07/11/Session_Report_2025_09_29_000000.csv.gz

Report Fields

The CAN Session report includes specific columns as explained below:

• Organization

• Site Name

• Username

• Email ID

• Is User Logged In

• Plan Name

• Policy Name

• Plan Start Date

• IP Address

• MAC Address

• Host Name

• Quota Used (in bytes)

• Login Date

• Logout Date

• Last Activity At

• Logout Cause

Kognitive Cloud Reports

• The Kognitive Cloud reports are automatically created at regular intervals and shared with Distribution Partners (DPs) through secure SAS tokens.

• Please refer the following page for information on How To: Access Kognitive Cloud Reports.

• Storage & Folder Structure - Reports are organized by DP ID → Report Type (site/activity) → Subtype (vessel/quota/etc.) → Date.

  • All Kognitice Cloud reports are stored in the following hierarchy:

    reports/
    └── DP/
    └── DP-00xx/ ← DP ID
    └── site/ ← Report type (site/activity)
    └── vessel/ ← Report subtype
    └── year=2025/
    └── month=06/
    └── day=03/
    └── Site_vessel_2025_06_03_014133.csv.gz

Types of Reports

• The following six types of Kognitive Cloud Reports are created

  • Site – Vessel
    Site dashboard data including usage distribution, WAN type usage, top apps, and internet status.

  • Site – Quota
    Quota usage per site (percentage used, max quota, estimated over-date).

  • Site – Location
    Hourly snapshot of site location (longitude, latitude, source).
    Sources include VSAT, LTE, Starlink, Manual and other sources like marine traffic.

  • Activity – Application
    Application-wise usage (download, upload, blocked).

  • Activity – Users
    User-wise usage including hostname, IP, MAC, device, VLAN, usage totals, top apps, and risk score.

  • Activity – Domain
    Domain-wise usage (download/upload volume, blocked hits).

Report Fields

Each report type includes specific columns as explained below:

Site – Vessel

• sitename (String) → Site name

• organization (String) → Organization of the site

• location (String) → City, country (calculated every 8 hrs)

• upload_usage / download_usage / total_usage (Integer) → WAN usage in bytes

• top_apps (String) → top 3 application used by site between start_time and end_time

• internet_status (String) → Llast 15 minutes internet status of site (possible values- Online/Offline/Unknown)

• start_time, end_time (Datetime) → Time range

• WAN breakdown: LTE, L-Band, Starlink, Wi-Fi, Wired, VSAT (multiple subtypes)

Site – Quota

• site_name (String) → Site name

• current_usage_percentage (Float) → % of quota used

• current_usage (Integer) → current usage in current quota in bytes

• usage_source (String) → source of usage data for quota calculation

• source_links_name (String) → All source type links names over which quota is set

• quotas (String) → all quota threshold percentage for this quota in ascending order

• quota_max (Integer) → total maximum quota values in bytes

• status (String) → current status of quota based on usage

• current_quota_start_time (Datetime) → current quota start time

• current_period (String) → total duation completed/total quota duration ,D for days,M for months

• estimated_over_date (String) → Calculated date when quota is exceeded

• query_time (Datetime) → time when this data is generated

Site – Location

• site_name (String) → Site name

• location_id (String) → internal system site id

• longitude, latitude (Float) → Location coordinates

• source (String) → Location source (VSAT, LTE, Starlink, etc.)

• location_time, start_time, end_time (Datetime) → Timestamps

The different location sources are -

VSAT - Data collected by VSAT controller in edge device

LTE - Data collected by LTE controller in edge device

Starlink - this data is collected by starlink telemetry. Its precision is h3 index level which is basically corresponds to 252.903858182 km2 hexagon size in map.

Manual - This data is entered by user. Either street address or either hard coded latitude and longitude in sports topology page (site name edit option).

Marine Traffic

Activity – Application

• dataType (String) → Download/Upload/Blocked

• usageFrom (String) → Application name

• usageTotal (Integer) → Usage in bytes or blocked hits

• start_time (Datetime) → start time of this data calculation

• end_time (Datetime) → end time of this data calculation

Activity – Users

• hostname, ipAddress, macAddress (String) → User identifiers

• device, vlan, site (String) → Connection details

• total, upload, download (Integer) → Usage in bytes

• topApps (String) → Top 3 applications

• top_risk (Float) → Max risk score

• captiveDeviceName (String) → Last captive user name

• start_time (Datetime) → start time of this data calculation

• end_time (Datetime) → end time of this data calculation

Activity – Domain

• dataType (String) → Download/Upload/Blocked

• usageFrom (String) → Domain name

• usageTotal (Integer) → Usage in bytes or blocked hits

• start_time (Datetime) → start time of this data calculation

• end_time (Datetime) → end time of this data calculation