"Drill-Down Top rate" summary type basically act as a filter in report. As mentioned in the Product documentation:
"First, this summary type creates a top rate summary of events. Then, the sections following the top rate summary use the data in the top rate summary to produce further charts and tables"
In other words, when you add a section with "Drill-Down Top rate" summary type, ALL following report sections (sections placed below "Drill-Down" section) will only collect data that is relating to the "Drill-Down" section. I created an example report showing this in use:
In this report "Traffic by user" section is using "Drill-Down Top rate" summary type. Report sections ABOVE this shows traffic by dst port and src IP from all traffic. Report sections BELOW "Traffic by user" section only shows traffic by dst port and src IP based in data seen in "Traffic by user" section.
Hopefully you understood my explanation
Thank you for Your answer.
I know how "drill-down" work - it not usable. If I need find TOP user with web usage and then look into sites... (
No I think about move Events to SIEM and create usable Dashboards.