Web Filter 3

Network Access Reports

Network Access Reports Basics

The Network Access Reports contain information on network access and usage in tabular format. These reports allow the administrator to complete a management task, such as ending an active override. They do not provide complete web visitor activity tracking.

To view a Network Access report, navigate to Reports and click Network Access in the Reports sidebar, then select the report to generate.

Reports included:

Authentication History

What does this report tell me?

The Authentication History report lists users who have logged into the Web Filter module to access web sites. This setting is controlled by the Authentication page in the Web Filter module settings.

Why should I use this report?

Use this report to see which users are logging into the Web Filter module to access the web. You can also manually expire (log out) user sessions.

How do I read it?

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter).

  • IP Address – The IP Address of the computer where the user logged in. User – The logged-in user’s network login name.
  • Computer – This column shows the computer name where the user logged in.
  • Device ID – The device ID (Host ID) of the mobile device.
  • Auth Source – The directory service that authenticated the user.
  • Auth Type – The method used to authenticate this user.
  • Time – This column shows the date and time when the Lightspeed Systems Web Filter module discovered the User.
  • Expires – When the authentication for the user will expire.
  • Gear Button – Click to select columns to view in this report.

Note: If the User and Computer columns are blank, the computer at this IP address is not running the User Agent.

Identification History

What does this report tell me?

The Identification History Report shows a historical list of user logins and logouts that the Lightspeed Systems Web Filter module recorded for the specified time interval.

Why should I use this report?

Use this report to track your Users’ logins as they move from computer to computer throughout your network.

How do I read it?

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter).

  • IP Address – The IP address of the computer where the user logged in.

The following columns are only populated if the computer is running the Lightspeed Systems User Agent service.

  • User – The logged-in user’s network login name.
  • User DN – The user’s Distinguished Name (DN). The DN uniquely identifies a user on your network.
  • User OU – The user’s Organizational Unit.
  • User Groups – The user’s Active Directory group memberships.
  • Computer – This column shows the computer name where the user logged in.
  • Computer DN – The computer’s Distinguished Name (DN). The DN uniquely identifies a computer on your network.
  • Computer OU – The computer’s Organizational Unit.
  • Action – The user action:
    • Login – The user was authenticated by the User Agent.
    • Logout – The user logged out of the Lightspeed Systems Web Filter module.
    • Authenticated – The user authenticated from the Access Page
    • Interrogation – The policy server detected traffic from the user’s IP address, and requested user information from the User Agent.
    • Heartbeat – The User Agent sent a periodic notification to verify that the user is still logged in.
    • Agent – The version of the User Agent on the device.
  • Auth Source – The directory service that authenticated the user.
  • Time – This column shows the date and time when the Lightspeed Systems Web Filter module discovered the User.
  • Expires – The date and time when the user’s current network login expires.
  • Gear Button – Click to select columns to view in this report.

Mobile Devices

What Does this Report Tell Me?

The Mobile Devices report shows a list of mobile devices that access your network.

Why Should I Use this Report?

Use this report to track usage of mobile devices accessing your network.

How Do I Read It?

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter).

  • Device ID – The device ID (Host ID) of the mobile device.
  • User – The user who registered this mobile device.
  • Auth Source – The authentication source used to register to this mobile device.
  • Last Checked In – The date when this mobile device last accessed your network.
  • First Checked In – The date when this mobile device first accessed your network.
  • Action – Click Delete to remove this mobile device from your network.
  • Gear Button – Click to select columns to view in this report.

Lockouts

What does this report tell me?

The Web Filter module temporarily locks out users who persistently try to visit blocked web sites. Locked out users lose their Internet access until the lockout expires. Use rule sets to configure lockout behavior.

Why should I use this report?

Use this report to audit excessive attempts to access blocked web sites.

How do I read it?

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter). The Category column has additional options to add the site to a local category, or visit the website in a new browser tab.

  • IP Address – The IP address of the locked out machine.
  • User – The logged-in user’s network login name.
  • Computer – This column shows the computer name where the user logged in.
  • Category – The Content Database category assigned to the requested site at the time the user was locked out.
  • Origin – This column shows the origin of the request (internal network clients, Mobile Filter clients, or Proxy clients).
  • Time – This column shows the date and time the user triggered the lockout for too many blocked requests.
  • Expires – The date and time when the lockout will automatically expire.
  • Expire Now – Click the X to reset a user’s lockout and re-enable Internet
  • Gear Button – Click to select columns to view in this report.

Note: If the User and Computer columns are blank, the computer at this IP address is not running the User Agent.

The following is the user view of a lockout. The lockout states Sorry, your access to the internet has been temporarily revoked. You have been identified as anonymous from (IP)

jjj

Bypass Ban

The Bypass Bans report identifies users who have been blocked due to attempting to bypass the Web Filter through the use of filter bypass clients such as Psiphon and Ultrasurf.

Learn more about: Blocking filter bypass clients

Overrides

What does this report tell me?

The Overrides report shows a list of users who have temporarily bypassed the content filter by supplying their login credentials on the access page.

Why should I use this report?

If you have configured rule sets to allow overrides, users can bypass the filter temporarily to visit blocked sites. Use this report to determine which users are accessing blocked content.

How do I read it?

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter).

  • IP Address – The IP address of the machine where the override was requested.
  • User – The username of the logged in person when the override was requested.
  • Computer – The host name of the machine where the override was requested.
  • Origin – This column shows the origin of the request (internal network clients, Mobile Filter clients, or Proxy clients).
  • Time – The date and time when the override occurred.
  • Expires – The date and time when the override will automatically expire.
  • Expire Now – Click the X to reset a user’s override request and block the
  • Gear Button – Click to select columns to view in this report.

Note: If the User and Computer columns are blank, the computer at this IP address is not running the User Agent.

Blocked for Review

What does this report tell me?

The Blocked for Review Report displays a list of blocked web sites where the user requests that you review the URL or domain to make sure the site is correctly categorized.

Why should I use this report?

Depending on how you have configured rule sets, users can submit blocked sites for review by an administrator. Occasionally, the Lightspeed Systems Web Filter module may include a site in a category that is ordinarily blocked, for example, Adult or Security. Use this report to view content that your users believe to be over-blocked. The report has links to allow you to add the site to a local category such as “local-allow”.

How do I read it?

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter). The Category column has additional options to add the site to a local category, or visit the website in a new browser tab.

  • IP Address – The IP Address of the user requesting the review.
  • URL – The URL of the blocked site. Click the URL to review the content in a new browser window.
  • Email – The email address of the user requesting the review.
  • Reason – Users can enter a brief message to explain why they feel a site should be recategorized.
  • Category – The Content Database category assigned to the site at the time it was blocked.
  • Recategorize – Click to open the Categorized Sites page, where you can add the site to a local category.
  • Time – The date and time when the review request originated.
  • Gear Button – Click to select columns to view in this report.