NetAuditor^® Report Types: Activity Detail

Reports

There are four types of Activity Detail reports. They are:

• The Activity Detail by Category report requires filter on a specific category.
• The Activity Detail by Domain report requires filter on a specific domain.
• The Activity Detail by Protocol report requires filter on a specific protocol.
• The Activity Detail by User report requires filter on a specific user.

Report Sections

Header

In the header of this report you will see the category, domain, protocol, or user that was used as the filter on the report. The device name, date range of the report and the total number accesses, also appears in the header of the report.

• Accesses/Total Accesses: An access is defined as one Get Request for HTTP, one Connection for HTTPS, one file for FTP, one login or group change for NNTP. For CHAT/P2P/VOIP/Streaming Media it depends on our individual signature for that protocol which maybe the login, connection, or file. Total accesses is the sum of all accesses for all supported protocols.

Top Protocols

This is a graphical representation of the percentage of total accesses by protocol.

Activity by Time

This is a graphical representation of total accesses by time. The time scale will vary based upon the date range selected. Run for one day it scales to hours, run for a week it scales to days, and run for months it scales by weeks.

Top (X) Categories

This shows the top (x) categories for all accesses during the date range of the report. You can see the entire listing of categories that we currently support , along with complete definitions of what belongs in each category here.

• Percent of Accesses: Percentage of the total number of accesses.
• Accesses: See above definition for accesses.
• Percent Blocked: Percentage of accesses that were blocked. (NetSpective reporting only)
• Volume: Total amount of data transferred. (Firewall/Proxy Server reporting only)

Top (X) Domains

This shows the top (x) domains for all accesses during the date range of the report. Domain names provide symbolic representations of IP addresses so that you do not have to use the numerical designation.

• Category: Shows the category for the domain listed, if contained within our database.
• Percent of Accesses: Percentage of the total number of accesses.
• Percent Blocked: Percentage of accesses that were blocked. (NetSpective reporting only)
• Sessions/Minutes: Estimate of surfing time of HTTP and HTTPS traffic based on user defined settings for Browser Session Timeout (in minutes) and Smallest Browser Session (in minutes). See below for details about these settings.
• Volume: Total amount of data transferred. (Firewall/Proxy Server reporting only)

Top (X) Users

This shows the top (X) users for all accesses during the date range of the report.

• Percent of Accesses: Percentage of the total number of accesses.
• Accesses: See above definition for accesses.
• Percent Blocked: Percentage of accesses that were blocked. (NetSpective reporting only)
• Volume: Total amount of data transferred. (Firewall/Proxy Server reporting only)

Contents Index

This is a chronological grouping that allows you to see the individual transactions that make up the accesses for the user during the date range of the report.

• Time: The date and time of the access.
• User (IP): The user name and IP address for the access. If there is no user name associated with the access just the IP address will be displayed.
• Protocol: Protocol used for the access.
• Category: Shows the category for the domain listed, if contained within our database.
• Action: Shows whether the access was allowed or blocked. (NetSpective reporting only)
• Volume: Shows the amount of data transferred for the access. (Firewall/Proxy Server reporting only)
• Accesses Detail: This displays the details of the access. It will display the protocol, the domain or IP address of the site accessed, the port number and for HTTP and HTTPS the full URL with the URI Query data.

Settings Effecting Sessions/Minutes

Browser Session Timeout

This setting tells NetAuditor how much inactivity to allow before closing a browsing session to start a new one. For instance, if a user generates a steady stream of HTTP traffic for 10 minutes, stops for 7 minutes, and then starts again for another 10 minutes, should that be seen as one browser session for 27 minutes, or two separate 10-minute browsing sessions that are 7 minutes apart? The user may have stopped browsing for 7 minutes, or he may have spent that time reading a web page or composing a web email. It is up to you to choose a timeout value that you feel gives the best results.

Smallest Browser Session

This setting tells NetAuditor to ignore sessions that are too short to be worth mentioning. This helps eliminate some of the "noise" mentioned above. If you have an RSS reader that generates a spike of traffic once every 30 minutes, but that spike only lasts for a minute or two, then setting this to 3 should eliminate that traffic. By itself, this setting does not remove very much of the unwanted noise. However, it works quite well when combined with the noise reduction setting below.