Web Filter Details Basics

Web Filter Details

Web Filter Details reports provide detailed information about user and network activity in tabular format. Filters allow you to filter these reports to just the information you want to see. To see a Web Filter reports, just click the report title in the Reports Gallery.

Reports included:

Web Filter reports always load as a blank page. This lets you specify search terms before running the report. To load the default report, click the Generate button at the bottom of the Data Options sidebar.

Activity Logs

What does this report tell me?

The Activity Logs report provides a list of URLs visited by users on your network. In addition, it shows all blocked TCP traffic.

Note: The Activity Logs report always loads as a blank page. This lets you specify search terms before running the report.

  • Click the filter report button [Clip 009] in the upper right corner to open the Data Options sidebar, then select the items to filter.
  • To load the default report, click the Generate button at the bottom of the Data Options

Why should I use this report?

Use this report to see which web sites your users are visiting.

Note: While search queries are recorded, the web requests made for the thumbnails resulting from Google and Bing image searches are not recorded due to their high volume.

How do I read it?

Note: With filtering, you can include or exclude data to customize your report. See Filtering Reports for more information.

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter). The Category column has additional options to add the site to a local category, or visit the website in a new browser tab.

URLfilter

  • Inspected Data – Click the Inspected Data icon to display only inspected data. Click it again to hide inspected data.
  • Destination – The destination URL of the requested site. Click the URL to review the content in the current browser window.
  • Action – Shows how the URL was filtered: Allowed, Redirected, or Blocked (mouse over each icon for a description).
  • Reason – Shows the reason the URL was allowed or blocked.
  • User – This column shows the logged in User name.
  • IP Address – This column shows the internal IP address.
  • User OU – This column shows the user’s Organizational Unit (OU).
  • User Groups – This column shows all of the user’s group memberships, including local groups.
  • Computer – This column shows the device name. A handset icon indicates that the device is a mobile device.
  • MAC – This column shows the MAC address of the device.
  • Category – The Content Database category assigned to the site.
  • Device ID – The device ID (Host ID) of the mobile device.
  • Category – The Content Database category assigned to the site.
  • Search Category – The Content Database category of the requested search.
  • Search Query – This column shows the word or phrase of the search query.
  • Rule Set – The Rule Set assigned to the user.
  • Origin – This column shows the origin of the request (internal network clients, Mobile Filter clients, or Proxy clients).
  • Time – This column shows the date and time the User made the request.
  • Gear Button – Click to select columns to view in this report.

Note: If the User and Computer columns are blank, the computer at this IP address may not be running the User Agent.

URL Logging

The Web Activity Report will display the complete URL in the Destination column for:

  • Blocked URLs.
  • All searches.
  • All overrides.
  • All HTTP youtube.com requests.

However, if a URL is allowed, only the hostname will be displayed. In addition, Web Filter caches all visits within 5 minutes by the same user to the allowed hostname into one This prevents unnecessary clutter and greatly reduces the size of the Activity Report.

Note: For Web Zones, only the allowed domains are displayed, not the complete URL.

Inspectors

With Inspectors, you can report fully-allowed URLs in detail. Inspectors can be applied to IP addresses, computer names, or user names.

Safe Search

If you have enabled Safe Search, the Web Filter may append some parameters to URLs falling under these categories. When this happens, the browser will be redirected to the newly formed URL. Please note that the originally-requested URLs will be logged as Redirected URLs.

 

Search Queries

What does this report tell me?

The Search Queries Report provides a detailed list of Users and what they searched for on the Internet.

Note: The Search Queries report always loads as a blank page. This lets you specify search terms before running the report.

  • Click the filter report button [Clip 009] in the upper right corner to open the Data Options sidebar, then select the items to filter.
  • To load the default report, click the Generate button at the bottom of the Data Options

Why should I use this report?

Use this report to audit User search activity and discover potentially inappropriate Internet usage.

How do I read it?

Note: With filtering, you can include or exclude data to customize your report. See Filtering Reports for more information.

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter). The Category column has additional options to add the site to a local category, or visit the website in a new browser tab.

URLfilter

  • Suspicious – A blue question mark (question) indicates that the search query is suspicious.

Note: You can filter this report to show only suspicious search queries or no suspicious queries. See Suspicious Search Queries for more information.

  • IP Address – The IP Address of the computer where the user logged in.
  • User – The logged-in user’s network login name.
  • User OU – The logged-in user’s OU.
  • User Groups – The logged-in user’s groups.
  • Computer – This column shows the computer name where the user logged in.
  • MAC – This column shows the MAC address of the device.
  • Device ID – The device ID (Host ID) of the mobile device.
  • Search Query – This column shows the word or phrase in the Search Query.
  • Domain – This column shows the search engine used to make the Search Query.
  • Category – The Content Database category assigned to the query.
  • Action – Shows whether the query was allowed or blocked.
  • Rule Set – The Rule Set assigned to the user.
  • Origin – This column shows the origin of the request (internal network clients, Mobile Filter clients, or Proxy clients).
  • Time – This column shows the date and time the User made the Search Query.
  • Gear Button – Click to select columns to view in this report.

Note: If the User and Computer columns are blank, the computer at this IP address is not running the User Agent.

Safe Search

If you have enabled Safe Search, the Web Filter may append some parameters to URLs falling under these categories. When this happens, the browser will be redirected to the newly formed URL. Please note that the originally-requested URLs will be logged as Redirected URLs.

Suspicious Search Queries

What does this report tell me?

The Suspicious Search Queries Report provides a detailed list of Users and suspicious or inappropriate Search Queries.

Note: The Suspicious Search Queries report always loads as a blank page. This lets you specify search terms before running the report.

  • Click the filter report button [Clip 009] in the upper right corner to open the Data Options sidebar, then select the items to filter.
  • To load the default report, click the Generate button at the bottom of the Data Options

Why should I use this report?

Use this report as a quick audit for potentially inappropriate Search Query activity.

How do I read it?

Tip: Click an item in the report grid to include only the selected item (Quick Filter) or add the item to the Data Options pane (Add to filter). The Category column has additional options to add the site to a local category, or visit the website in a new browser tab.

  • IP Address – This column shows the IP address of the computer where the Search Query originated. Click IP address to view a set of detailed reports specific to that IP address.
  • User – This column shows the logged-in User name. Click User to a view a set of detailed reports specific to that User.
  • Computer – This column shows the Computer name where the Search Query originated. Click Computer to view a set of detailed reports specific to that Computer.
  • Search Query – This column shows the suspicious word or phrase in the Search Query.
  • Domain – This column shows the search engine used to make the Search Query.
  • Category – The Content Database category assigned to the domain at the time of the query.
  • Time – This column shows the time the User made the suspicious Search Query.
  • Gear Button – Click to select columns to view in this report.

Note: If the User and Computer columns are blank, the computer at this IP address is not running the User Agent.

Blocked Content

Note: This report is a customized version of the Web Activity report that you can modify and save as your own custom report.

What does this report tell me?

The Blocked Content report displays every domain, URL, or IP address that was blocked by the Web Filter.

When should I use this report?

Use this report to see which blocked websites your users are attempting to visit.

How do I read it?

For detailed information on this report, click to view the Web Activity report help page.

Blocked Search Queries

Note: This report is a customized version of the Search Queries report that you can modify and save as your own custom report.

What does this report tell me?

This report lists all search engine queries that were blocked by the Web Filter. They were blocked because the search terms included keywords or phrases included in the Search Engine Keywords table that were categorized in a blocked category.

When should I use this report?

Use this report to see what terms your users are searching for.

Note: While search queries are recorded, the web requests made for the thumbnails resulting from Google and Bing image searches are not recorded due to their high volume.

How do I read it?

For detailed information on this report, click to view the Search Queries report help page.

 

Lockout Activity

Note: This report is a customized version of the Web Activity report that you can modify and save as your own custom report.

What does this report tell me?

The Lockout Activity Report provides a list of users who triggered a lockout because of multiple inappropriate URL attempts.

When should I use this report?

Use this report to see which users are being locked out by the web filter.

How do I read it?

For detailed information on this report, click to view the Web Activity report help page.

Bypass Ban Activity

What does this report tell me?

The Bypass Ban Activity report shows you which users were blocked from accessing content because they attempted to use a bypass client.

Learn more about: Blocking bypass clients

Why should I use this report?

Use this report as a quick audit for users who are trying to subvert the Web Filter through the use of a bypass client.

How do I read it?

  • Destination – The URL the user was attempting to access.
  • IP Address – This column shows the IP address of the computer where the Search Query originated. Click IP address to view a set of detailed reports specific to that IP address.
  • Reason – The reason why the block was initiated (in this case this will always be Filter Bypass)
  • User – This column shows the logged-in User name. Click User to a view a set of detailed reports specific to that User.
  • Time – This column shows the time the User made the suspicious Search Query.

Mobile Filter - Blocked URLs

Note: This report is a customized version of the Web Activity report that you can modify and save as your own custom report.

What does this report tell me?

The Blocked URLs report shows all web requests (URLs) that were blocked by the Lightspeed Mobile Filter.

When should I use this report?

Use this report to see which blocked web sites your users are attempting to visit.

How do I read it?

For detailed information on this report, click to view the Web Activity report help page.

Mobile Filter - URLs Attempted

Note: This report is a customized version of the Web Activity report that you can modify and save as your own custom report.

What does this report tell me?

The URLs Attempted report shows all web requests (URLs) that were attempted by the users through the Lightspeed Mobile Filter.

When should I use this report?

Use this report to see which web sites your users are attempting to visit.

How do I read it?

For detailed information on this report, click to view the Web Activity report help page.

Mobile Filter - Unknown URLs

Note: This report is a customized version of the Activity Logs report that you can modify and save as your own custom report.

What does this report tell me?

The Mobile Filter – Unknown URLs report displays a list of all requested URLs that were not found in the Content Database. This report shows requests via the Lightspeed Mobile Filter only.

When should I use this report?

The unknown URLs can be reviewed and categorized into the local database directly from this report. Additionally, these items will be automatically uploaded to Lightspeed for categorization, then included in the nightly update and added to the local database.

How do I read it?

For detailed information on this report, click to view the Web Activity report help page.

Unknown URLs

Note: This report is a customized version of the Web Activity report that you can modify and save as your own custom report.

What does this report tell me?

The Unknown URLs report displays a list of all requested URLs that were not found in the Content Database.

When should I use this report?

The unknown URLs can be reviewed and categorized into the local database directly from this report. Additionally, these items will be automatically uploaded to Lightspeed for categorization, then included in the nightly update and added to the local database.

How do I read it?

For detailed information on this report, click to view the Web Activity report help page.