Summary investigative reports

Initially, the investigative reports page gives a summary report of usage for all users by risk class, showing the current day’s activity from the Log Database. The measurement for this initial bar chart is Hits (number of times the site was requested). To configure the time period for this initial summary report, see Database connection and report defaults.

Use the links and options on the page to quickly change the information reported, or drill down into the report details.

  1. Customize the way that results are quantified by selecting one of the following options from the Measure list.
    Option Description
    Hits

    The number of times the URL was requested.

    Depending on how Log Server is configured, this may be true hits, which logs a separate record for each separate element of a requested site, or it may be visits, which combines the different elements of the site into a single log record.
    Bandwidth [KB] The amount of data, in kilobytes, contained in both the initial request from the user and the response from the website. This is the combined total of the Sent and Received values.
    Sent [KB] The number of kilobytes sent as the Internet request. This represents the amount of data transmitted, which may be a simple request for a URL, or may be more significant (for example, if the user is registering for a website.)
    Received [KB]

    The number of kilobytes of data received in response to the request, including all text, graphics, and scripts on the page.

    For sites that are blocked, the number of kilobytes varies according to the software creating the log record. When Network Agent logs the records, the number of bytes received for a blocked site represents the size of the block page.

    If the log record is created by Content Gateway, as a result of analysis, the kilobytes received represents the size of the page analyzed. See Content Gateway Analysis.

    If a third-party integration product creates the log records, the kilobytes received for a blocked site may be zero (0), may represent the size of the block page, or may be a value obtained from the requested site.
    Browse Time

    An estimate of the amount of time spent viewing the site. See What is Internet browse time?.
  2. Change the primary grouping of the report by selecting an option from the Internet Use by list above the report.

    Options vary according to the contents of the Log Database and certain network considerations. For example, if there is only one group or domain in the Log Database, Groups and Domains do not appear in this list. Similarly, if there are too many users (more than 5,000) or groups (more than 3,000), those options do not appear. (Some of these limits can be configured. See Display and output options.)

  3. Click a name in the left column (or the arrow beside the name) to display a list of options, such as by user, by domain, or by action.

    The options listed are similar to those listed under Internet Use by, customized to be a meaningful subset of the content currently displayed.

    Note: Sometimes an option, such as User or Group, appears in red lettering. In this case, selecting that option may produce a very large report that may be slow to generate. Consider drilling down further into the details before selecting that option.
  4. Select one of those options to generate a new summary report showing the selected information for the associated entry.

    For example, on a Risk Class summary report, clicking by User under the Legal Liability risk class generates a report of each user’s activity in the Legal Liability risk class.

  5. Click a new entry in the left column, and then select an option to see more detail about that particular item.
  6. Use the arrows beside a column heading to change the report’s sort order.
  7. Control the summary report with the following options above the chart. Then, delve into related details by clicking the elements of the new report.
    Option Action
    Report path (User > Day) Beside the Internet use by list is a path showing the selections that created the current report. Click any link in the path to return to that view of the data.
    View

    Select a period for the report: One Day, One Week, One Month, or All. The report updates to show data for the selected period.

    Use the adjacent arrow buttons to move through the available data, one period (day, week, month) at a time.

    As you change this selection, the View from fields update to reflect the time period being viewed.

    The View field displays Custom, instead of a time period, if you choose specific date in the View from fields or through the Favorites dialog box.
    View from... to...

    The dates in these fields update automatically to reflect the time period being viewed when you make changes in the View field.

    Alternatively, enter exact start and end dates for the reports, or click the calendar icon to select the desired dates.

    Click the adjacent right arrow button to update the report after selecting dates.
    Pie Chart / Bar Chart

    When the bar chart is active, click Pie Chart to display the current summary report as a pie chart. Click the slice label to display the same options that are available when you click an entry in the left column of the bar chart.

    When the pie chart is active, click Bar Chart to display the current summary report as a bar chart.
    Full Screen Select this option to display the current investigative report in a separate window, without the left and right navigation panes.
    Anonymous / Names
    • Click Anonymous to have reports display an internally- assigned user identification number wherever a user name would have appeared.
    • When names are hidden, click Names to return to showing user names.

    Under some circumstances, user names cannot be displayed. For more information, see Configuring how requests are logged.

    For more information about hiding user-identifying information, see Anonymizing investigative reports.
    Search for

    Select a report element from the list, then enter all or part of a value for the search in the adjacent text box. Click the adjacent arrow button to start the search and display results.

    Entering a partial IP address, such as 10.5., searches for all subnets, 10.5.0.0 through 10.5.255.255 in this example.

    See Using search to generate a summary investigative report for more details.
  8. Add a subset of information for all or selected entries in the left column by creating a multi-level summary report. See Multi-level summary investigative reports.
  9. Create a tabular report for a specific item in the left column by clicking the adjacent number or measurement bar. This detailed report can be modified to meet your specific needs. See Flexible detail investigative reports.