User Activity Detail investigative reports

Administrator Help | Forcepoint Web Security and Forcepoint URL Filtering | v8.5.x

Click the User by Day/Month link to generate a User Activity Detail report for one user. This report gives a graphical interpretation of the user's Internet activity for a single day or a full month.

First, generate a report for a specific user for a selected day, as described below From that report, you can generate a report of the same user's activity for a full month.

Select User by Day/Month at the top of the main page. The User Detail by Day dialog box appears.

Enter a user's name, or a portion of the name, in the Search for user field, and then click Search.

The search displays a scrolling list of up to 100 matching user names from the Log Database.

Make a selection from the Select user list.

In the Select day field, either accept the last activity date that appears by default, or choose a different date.

You can type the new date or click the calendar icon to select a date. The calendar selection box indicates the date range covered by the active Log Database.

Click Go to User by Day to see a detailed report of activity for that user on the requested date.

The initial report shows a timeline of the user's activity in 5-minute increments. Each request appears as an icon, which corresponds to a Forcepoint URL Database category. A single icon represents all custom categories. (The color of the icons corresponds to the risk grouping shown on the User Activity by Month reports.)

Rest the mouse over an icon to show the exact time, category, and action for the associated request.

Use the controls listed below to modify the report display or to see a legend.


Option	Description
Previous Day / Next Day	Display this user's Internet activity for the previous or next calendar day.
Table View	Displays a list of each requested URL, giving the date and time of the request, the category, and the action taken (blocked, permitted, or other).
Detail View	Displays the initial, graphical view of the report.
Group Similar Hits / View All Hits	Combines into a single row all requests that occurred within 10 seconds of each other and have the same domain, category, and action. This results in a shorter, summarized view of information. The standard time threshold is 10 seconds. If you need to change this value, see Display and output options. After you click the link, it becomes View All Hits, which restores the original list of each request.
Category View Control	Displays a list of each category in the current report, showing both the category name and the icon representing that category. Control which categories appear in the report by marking the check boxes for the categories to be included. Then, click Accept to update the report according to your selections.

Click User Activity Detail by Month, above the report, to view the same user's activity for the full month.

The new report displays a calendar image, with each day's area showing small colored blocks representing the user's Internet activity for that day. Requests to sites in custom categories are shown as gray blocks.

Click Database Category Legend at the top left to see how the colors represent low to high potential risk for the requested site.

The category assignments are fixed, and cannot be changed.

Click Prev or Next to display this user's Internet activity for the previous or the next month.