Using the Transaction Viewer

Administrator Help | Forcepoint Web Security and Forcepoint URL Filtering | v8.5.x

Related topics:

Create a new report with Transaction Viewer

Transaction Viewer display options

Export Transaction Viewer data

Using the Report Builder to create a report

Report Center Report Catalog

Use the Report Center > Transaction Viewer to create detail reports. The Transaction Viewer provides granular information for each record. The data can be manipulated by adding filters and columns to the report.

Access the Transaction Viewer:

Directly from the Report Center menu.

From the Report Builder by:

Selecting one or more rows of data and selecting View Transactions in the popup window.

Clicking an entry in any metrics column.

Clicking an entry in a bandwidth related metrics column adds the corresponding metric to the Transaction Viewer report. (Added in v8.5.3)

When accessed from the Report Builder page, the Transaction Viewer opens using the same filters and dates, and adding your selections to the Filters field.

Within the Transaction Viewer, toolbar options allow you to:

Create a new report.

Select the New button to clear the report pane and start creating a new report.

Save a report.

Schedule a saved report. (Added in v8.5.3)

The Report Center Scheduler > Add Job > Report Selections window opens and the new report is automatically included in the Scheduled Reports list.

The availability of the Schedule icon is based on the delegated administrator permissions to use the Report Center Scheduler. The Schedule reports option must be selected in order to navigate to the Report Center Scheduler.

Use Save As to save the report to a different name.

Share a saved report. (Added in v8.5.3) See Share a report.

Export a report.

Create a new report with Transaction Viewer

If necessary, click the New button to clear the report pane.

The Attributes list, in the left pane, contains the data types that you can use to filter report data. The Metrics list includes the metrics that are available for the report.

Add filters to a report by dragging attributes or metrics to the Filters field. Use the search box above the list to further filter the list of attributes.

When the popup window appears after selecting from the Attributes list:

Select an entry from the drop-down list to configure the filter to return the exact information you need.

The drop-down options depend on the selected attribute. For example, you may be able to include, exclude, or start with specified values.


	Note With v8.5.3, User cannot be used as a filter by any delegated administrator who does not have permission to View user names and hostnames in reports. See Delegated Administration and Reporting for more information.

Enter or select the terms or values that you want to filter on. Depending on the filter, you can:

Select one or more check boxes.

Start typing text that will autocomplete based on data in the system.

As you type, a list of potential matches is provided. Select the option you want. Multiple values can be added to the filter by typing more text and selecting from the new list of potential matches.

Enter the exact text that you want to use.

Multiple terms can be added as a list of items, one item per line.


	Note Delegated administrator access to user information is defined on the Delegated Administrator > Edit Roles page and determines what is viewed if User is a report column. See Delegated Administration and Reporting for additional information.

When the popup window appears after selecting from the Metrics list:

Select an equality option from the drop-down.

Enter a number to apply to the equation that will become part of the filter.


	Important Using any of the IP address attributes as a Filter or Column may impact performance and the report may take a long time to generate.

Select a Date range to define the time period covered by the report. This can be a standard period (between Today and the Last 3 months) or a specific date and time range.

Last 7 days is used by default for new reports.

Clicking the entry field opens the Date Range popup.

Specify a set period by selecting an option from the drop-down list provided.

Specify a date range by using the calendars to select a From and To date.

Check Specify start and end time to add specific times for the report.

If this selection is not used, the full 24-hour period is applied to each date in the date range.

Click Done to close the window and apply the new dates. Otherwise, click Cancel.

Select the data elements for the report from the Columns drop-down list. Click Close after making your selections.


	Important Using any of the IP address attributes as a Filter or Column may impact performance and the report may take a long time to generate.

Columns can also be added by dragging and dropping from the Attributes list.

Note, however, that Group and Risk Class are available as attributes but not as options in the drop-down. Those attributes cannot be added as columns.

Date & Time and URL are included in each new report, by default.

Delete columns by clicking the "x" icon in the column heading.

The current active column cannot be deleted.

Add Metrics to each report by dragging and dropping selections to the report results area or by selecting them from the Columns drop-down.

Bandwidth (bytes received plus bytes sent), Browse Time, Bytes Received, Bytes Sent, and Requests can be added to a report.

In the Transaction Viewer, bandwidth values are reported in bytes.

The list of metrics changes depending on the selected attributes.

When you have finished adding filters and metrics and selected a date range, click Update Report to generate the report.

The Update Report button turns yellow when you add or change report content to indicate that an update is needed to apply the changes.

Sort the report data by clicking a column heading.

A down arrow appears, indicating that the data will be sorted in descending order, by that column.

Click the arrow to change the sort order to ascending.

The sort options can also be changed after the report has been generated.

Use the Date column, not the Time column, to sort by time. Sorting by Date will order the transactions by both date and time.

When you have finished creating the report, click Save in the toolbar.

Enter a Name and, optionally, a Description for the report.

A maximum of 200 characters can be used for the report name. The description can be a maximum of 400 characters.

Select a Folder in which the report should be stored.

Click Save Report to save the report in the selected folder.

Use Save As if you have edited a report and wish to keep the original in tact.

Transaction Viewer display options

Transaction Viewer display options allow you to:

Enable Detail view after highlighting a record in the report. Alternatively, double-click a record in the report.

A Transaction Details section is added at the bottom of the page.

Select General to view details such as user and group information, policy information, and category information.

If a user is a member of multiple groups, the first 10 groups are listed. Click View all groups to display the full list.

Select Request Details to view details such as source and destination IP addresses, full URL, or port and protocol information.

Select Cloud Apps to view information about a cloud app that was requested.

This tab will not display for transactions that do not include cloud app data.

Note that "none" will display on this tab if the Monitor Only cloud apps filter was applied to the request.

Select Threat Details (added in v8.5.3) to view details about any threat that may be associated with the request. The tab displays only if there is threat related data in the selected transaction.

By default, 30 days of threat data is maintained in the Log Database. This value can be configured on the Web > Settings > Reporting > Dashboard page of Forcepoint Security Manager.

Access to this tab is based on the delegated administrator role and the Reporting Permissions assigned to it. See Delegated Administration and Reporting.

Select Forensics Data (added in v8.5.3) to view information about files associated with threat activity and attempts to access them. The tab displays only if forensics data is available in the selected transaction.

Forensic data is available only if Store forensic data about Threat incidents for further investigation is selected on the Web > Settings > Reporting > Dashboard page of Forcepoint Security Manager. The type of data collected and length of time to store the data is also configured on that page.

When available, forensics data is included in the output when one of the export options is used.

Access to this tab is based on the delegated administrator role and the Reporting Permissions assigned to it. See Delegated Administration and Reporting.

Select Advanced to view request information such as total bandwidth used and browser and operating system information.

Disable Detail View to return to the table format.

Select the number of rows for each report.

Page through longer reports.

Export Transaction Viewer data

Export the report details using the export icons at the top of the page.

Click Export to CSV to generate a file in CSV format.

A message displays indicating that the export was successful.

Use the browser options provided to Open an Excel spreadsheet or Save the spreadsheet to your Downloads folder.

Click Export to PDF to generate a PDF file.

In the Export Options window, enter a Name for the report and, optionally, a Description.

Select the Page size and Orientation.

Click Export to create the PDF file or Cancel to return to the Transaction Viewer.

Use the browser options provided to Open the PDF or Save the file to your Downloads folder.

Note that Export to PDF does not support all languages.

Use the boxes next to each record to select one or more transactions. Then select Export to PDF or Export to CSV. Select Cancel Selections to close the pop-up.

When Export to PDF is selected, a new Export Options pop-up displays.

Enter a report Name and Description.

Select Table view to export the data for the selected transactions.

Select Details view to include the details for each selected transaction.

Indicate whether the paper size should be Letter or A4.

Select either Portrait or Landscape orientation.

Click Export to create the PDF file or Cancel to return to the Transaction Viewer.

Use the browser options provided to Open the PDF or Save the file to your Downloads folder.

Note that Export to PDF does not support all languages.

When Export to CSV is selected, use the browser options provided to Open an Excel spreadsheet or Save the spreadsheet to your Downloads folder

A maximum of 10,000 table rows can be exported to a PDF file, a maximum of 20,000 table rows to CSV. Data exported using Details view can include a maximum of 20 transactions.