topic Meaningful User Reports in General Topics

Meaningful User Reports

PinkCup — Thu, 03 Dec 2015 01:53:15 GMT

PA-500
Software Version 7.0.3

How do I generate meaningful user reports, or how do I better interpret the reports that are available.

With a User Activity Report I get application statistics, browsing summary by category etc. But I can't say "User domain\user was on these sites between 10am and 11am when they should have being working".

With the detailed User Activity Report I get the URLs, but they are interspersed with all of the URLs the user doesn't see (advertising, hosted images etc - for example

www.google.com/searchdomaincheck?format=domain&type=chrom

)

Is there a way I can produce a report to give to a manager to confidently say that his/her staff member was on non work websites between certain hours, or totals over the day. And then how long they were on those sites, or how much they clicked around those websites?

Re: Meaningful User Reports

reaper — Thu, 03 Dec 2015 09:31:42 GMT

If your only concern, regarding the user activity report, is to check which undesirable sites are accessed during business hours, you could try the following scenario:

create an 'off-hour' url filtering profile and a 'during-hours' url profile

in the off hours, set all allowed categories to 'allow' and all blocked ones to blocked, but don't use alert

in the 'on' hours profile, set all the undesirable categories to alers, leave all the benign categories as allow and still block undesirable categories

then create a schedule object that containing either the office or off-hours

next, create 2 identical security policies, the top one containing the schedule and the appropriate url filtering profile (eg. offhours schedule and off-hours url filtering profile), the one below using the other url filtering profile (eg. office hours) and no schedule

this will let people browse without being logged outside of office hours

alternatively, but a little more invasive, you could set the 2 same profiles as above, but instead of alert you could set a 'continue' action, which will prompt users if they truly want to continue onto the website during office hours, but would simply allow them during off-hours

these will show as block-continue in the url filtering log when the page is presented and 'continue' if the user opts to go on

Re: Meaningful User Reports

scottyfresh — Thu, 03 Dec 2015 19:38:35 GMT

We recently started logging at the beginning and end of sessions to monitor users upon request. This breaks down time spent in a specific application category.

In the past we only had logging at the end of sessions.