You can use the User Activity dashboard to get visibility into an individual users’ browsing patterns: their most frequently visited sites, the sites with which they’re transferring data, and attempts to access high-risk sites. The data here is based on what’s reported in your URL Filtering logs. This report also depends on the Cloud Identity Engine (formely Directory Sync)—the Cloud Identity Engine gives you read-only access to your Active Directory information, so you can filter this report based on user. If you haven’t yet set up the Cloud Identity Engine, here’s how. Or, if you already have it set up, here’s how to integrate the Cloud Identity Engine with your app. Monitoring the user activity helps to detect and stop potential threats, protect sensitive information being misused, and adjust your security policy rule to close security gaps.

For more information, see Dashboard: User Activity.