The following TQL queries are for BlueCoat http_proxy.
Identify the top domains blocked by proxy policy
class:bluecoat_http_proxy exceptiontype:policy_denied | groupby domain
Identify the bottom domains blocked by proxy policy
class:bluecoat_http_proxy exceptiontype:policy_denied | groupby < domain 100
Identify actions and exceptions generated by the BlueCoat web proxy
class:bluecoat_http_proxy | groupby [action,exceptiontype]
Identify the top categories blocked by the BlueCoat web proxy
class:bluecoat_http_proxy | groupby exceptiontype