Investigative reports

Web Security Help | Web Security Solutions | Version 7.8.x

Related topics:

Summary reports

Multi-level summary reports

Flexible detail reports

User Activity Detail reports

Standard reports

Favorite investigative reports

Scheduling investigative reports

Outliers reports

Output options for investigative reports

Database connection and report defaults

Use the Reporting > Investigative Reports page to analyze Internet activity in an interactive way.

Initially, the main Investigative Reports page shows a summary report of activity by risk class (see Risk classes).

Work in the summary report view by clicking the available links and elements to explore areas of interest and gain general insight into your organization's Internet usage (see Summary reports).

Multi-level summary reports (see Multi-level summary reports) and flexible detail reports (see Flexible detail reports) let you analyze the information from different perspectives.

Other report views and investigative reports features can be accessed from links at the top of the page. See the table below for a list of links and the features they access. (Not all links are available on all pages.)


Option	Action
User by Day/Month	Displays a dialog box that lets you define a report of a specific user's activity, covering either a day or a month. For more information, see User Activity Detail reports.
Standard Reports	Displays a list of predefined reports so you can quickly see a specific combination of data. See Standard reports.
Favorite Reports	Lets you save the current report as a Favorite, and displays a list of existing Favorites that you can generate or schedule. See Favorite investigative reports.
Job Queue	Displays the list of scheduled investigative reports jobs. See Scheduling investigative reports.
Outliers	Displays reports showing Internet usage that is significantly different from average. See Outliers reports.
Options	Displays the page for selecting a different Log Database for reporting. The Options page also lets you customize certain reporting features, such as the time period initially shown on summary reports and the default columns for detail reports. See Database connection and report defaults.
	Click this button, at the right of the Search fields, to export the current report to a spreadsheet file compatible with Microsoft Excel 2003 or later. You are prompted to either open or save the file. See Output options for investigative reports.
	Click this button, at the right of the Search fields, to export the current report to a PDF file compatible with Adobe Reader v7.0 or later. You are prompted to either open or save the file. See Output options for investigative reports.

Beginning with 7.8.4, investigative reports support IPv6 for source and destination IP addresses. Also, anywhere an IP address can be entered in an investigative reports feature, both IPv4 and IPv6 formats are accepted.

Keep in mind that reporting is limited to the information that has been recorded in the Log Database.

If you disable logging for user names, IP addresses, or selected categories (see Configuring how requests are logged), that information cannot be included.

Similarly, if you disable logging for certain protocols (see Editing a protocol filter), requests for those protocols are not available.

If you want reports to show both the domain name (www.domain.com) and the path to a particular page in the domain (/products/productA) you must log full URLs (see Configuring how URLs are logged).

If your directory service does not include the first and last name of the user, reports cannot display user name information.

Investigative reports are limited by the processor and available memory of the TRITON management server, as well as some network resources. Some large reports may take a very long time to generate. The progress message includes an option to save the report as a Favorite so you can schedule it to run at another time. See Scheduling investigative reports.