Generate User/Group Activity Reports
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
- PAN-OS 9.1 (EoL)
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1 (EoL)
Generate User/Group Activity Reports
User/Group Activity reports summarize the
web activity of individual users or user groups. Both reports include
the same information except for the Browsing Summary
by URL Category and Browse time calculations,
which only the User Activity report includes.
You must configure User-ID on the firewall
to access the list of users and user groups.
- Configure the browse times and number of logs for User/Group Activity reports.Required only if you want to change the default values.
- Select DeviceSetupManagement, edit the Logging and Reporting Settings, and select the Log Export and Reporting tab.For the Max Rows in User Activity Report, enter the maximum number of rows that the detailed user activity report supports (range is 1-1048576, default is 5000). This determines the number of logs that the report analyzes.Enter the Average Browse Time in seconds that you estimate users should take to browse a web page (range is 0-300, default is 60). Any request made after the average browse time elapses is considered a new browsing activity. The calculation uses container pages (logged in the URL Filtering logs) as the basis and ignores any new web pages that are loaded between the time of the first request (start time) and the average browse time. For example, if you set the Average Browse Time to two minutes and a user opens a web page and views that page for five minutes, the browse time for that page will still be two minutes. This is done because the firewall can’t determine how long a user views a given page. The average browse time calculation ignores sites categorized as web advertisements and content delivery networks.For the Page Load Threshold, enter the estimated time in seconds for page elements to load on the page (default is 20). Any requests that occur between the first page load and the page load threshold are assumed to be elements of the page. Any requests that occur outside of the page load threshold are assumed to be the user clicking a link within the page.Click OK to save your changes.Generate the User/Group Activity report.
- Select MonitorPDF ReportsUser Activity Report.Click Add and then enter a Name for the report.Create the report:
- User Activity Report—Select User and enter the Username or IP address (IPv4 or IPv6) of the user.
- Group Activity Report—Select Group and select the Group Name of the user group.
Select the Time Period for the report.(Optional) Select the Include Detailed Browsing check box (default is cleared) to include detailed URL logs in the report.The detailed browsing information can include a large volume of logs (thousands of logs) for the selected user or user group and can make the report very large.To run the report on demand, click Run Now.To save the report configuration, click OK. You can’t save the output of User/Group Activity reports on the firewall. To schedule the report for email delivery, see Schedule Reports for Email Delivery.