diff --git a/app/controllers/analytics_controller.rb b/app/controllers/analytics_controller.rb
index fe49fa8..8c31a13 100644
--- a/app/controllers/analytics_controller.rb
+++ b/app/controllers/analytics_controller.rb
@@ -45,15 +45,7 @@ class AnalyticsController < ApplicationController
       Event.where("timestamp >= ?", @start_time)
            .group(:waf_action)
            .count
-           .transform_keys do |action_id|
-        case action_id
-        when 0 then 'allow'
-        when 1 then 'deny'
-        when 2 then 'redirect'
-        when 3 then 'challenge'
-        else 'unknown'
-        end
-      end
+           # Keys are already strings ("allow", "deny", etc.) from the enum
     end
 
     # Top countries by event count - cached (now uses denormalized country column)
@@ -151,7 +143,7 @@ class AnalyticsController < ApplicationController
     # ASN breakdown (using denormalized asn columns)
     @top_asns = Event.where("timestamp >= ? AND asn IS NOT NULL", @start_time)
                      .group(:asn, :asn_org)
-                     .select("asn, asn_org, COUNT(*) as event_count, COUNT(DISTINCT ip_address) as unique_ips")
+                     .select("asn, asn_org, COUNT(*) as event_count, COUNT(DISTINCT ip_address) as unique_ips, COUNT(DISTINCT network_range_id) as network_count")
                      .order("event_count DESC")
                      .limit(15)