Application reporting

Web Security Help | Web Security Solutions | Version 7.8.x

Related topics:

How is user agent data collected?

Browser use details

Platform use details

In Web Security Gateway and Gateway Anywhere deployments, and standalone Web Security and Web Filter deployments, use the Reporting > Applications page to review the browsers and operating systems used to make web requests in your network. You an also use the Search tab to investigate activity based on user agent strings. (The user agent string is an HTTP header that identifies the client software from which a request originates.)

Find instances of older browsers that may present a security vulnerability.

Identify which machines in your network may be vulnerable when a zero-day exploit is discovered.

Track adoption of new browsers and operating systems.

Use the user agent string associated with an application to identify the machines in your network on which that application is running.

Search for user agent strings associated with malware or suspicious activity to identify machines that may be at risk.

Beginning with 7.8.4, application reports support IPv6 addresses.

In Web Security and Web Filter deployments that are integrated with a third-party proxy, cache, firewall, or other device, the integration product does not send application data to Websense Filtering Service. As a result, no data is available on the Applications page.


	Important After a new installation or upgrade, the Applications page will not show data on the Browser or Source Platform tab until a nightly database job runs. As users connect to the Internet, new user agent strings appear on the Search tab, but the strings are not parsed into recognized browsers and platforms until the job runs.

See How is user agent data collected? for more information about how user agent data is logged, processed, and made available for use in reports.

The Applications page is made up of 3 tabs:

Reports on the Browser tab show which supported browser families (including desktop and mobile versions of Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera) and versions are being used to access the Internet from your network.

The Browser tab is selected by default when you navigate to the Applications page.

Reports on the Source Platform tab show which supported operating systems (including Windows, Linux, UNIX, OS X, iOS, Android, BlackBerry, Symbian, and Java ME) the browsers accessing the Internet are running on.

The Search tab lets you search for specific strings in user agent headers detected in your network. The search results show the top qualifying user agents by requests or bandwidth.

On any tab, you can select an alternate Time period from the drop-down list at the top of the tab. By default, 30 days worth of information (if available) is shown in the charts and tables.

Different time periods are available depending on whether you use a standard or enterprise version of Microsoft SQL Server, or Microsoft SQL Server Express.

On the Browser and Source Platform tabs, you can also select a Device type (desktop or mobile) to limit the information that appears on the page. By default, information for both desktop and mobile browsers or platforms is shown.

Both the Browser and Source Platform tabs include a table that lists browsers or platforms and versions.

An icon in the Type column indicates whether the browser or platform is for desktop machines or mobile devices.

The next column gives the name of the browser family or operating system platform.

The Lowest Version and Highest Version values give the range of versions being used in your network during the selected period.

Number of browsers of the specified type actively being used to make requests, or of source platforms from which requests are originating. The count is made based on the number of unique client IP addresses associated with the browser or operating system.

Click a link in the table to open a detail report with more information about the selected browser family, platform, or version number. See Browser use details or Platform use details for more information.

Use the Browser Family or Platform Comparison chart to view the top browser families or operating systems used in your network, and the Browser or Platform Use Trend chart to track use of the different browsers or operating systems over time.

For any chart, select a different Chart type to change the way the information is displayed.

The Search tab initially displays the top 10 user agents, based on number of requests. To search the database for specific user agents, enter a string in the User agent field and click Search. The string can be all or part of a user agent header, up to a maximum of 128 characters.

The top (up to 200) results that match your search string are displayed in the User Agent Search Results table, which includes:

The actual User Agent that matches the search criteria. If the string is truncated, mouse over it to see the full string.

The last column header shows whether results are sorted by Requests or Bandwidth. (Use the Sort by list to choose a measurement.)

After performing a search, click Clear to return to showing the default Top 10 User Agents table.

Click a user agent in the Top 10 or Results table to display a User Agent Detail table at the bottom of the page. The details table shows:

The User whose browsing included the user agent.

The Client IP Address from which the request originated.

The Source Server IP Address for the integration component (Content Gateway or Network Agent) processing the requests.

The number of Requests that included the selected user agent.

The volume of Bandwidth for all requests that include the user agent from the specified user and client machine.

Click Export to CSV to export the report detail information to a CSV file that can be manipulated using spreadsheet software like Microsoft Excel.


	Note If there are more records than your system can handle, the output file will not contain actual CSV-format data. If this occurs, select a shorter timeframe to reduce the data set and export the data again.