Sophos Web Appliance | Reports | 167
■
■
User: The username associated with the machine when the threat was detected. Clicking this will display a search for suspicious activity by this machine/user combination.
Count: The number of times this particular IP/username combination has been detected as a threat.
■ Details: The name or names of any detected threats. Clicking the name of a threat will open the webpage with the corresponding Sophos threat analysis.
To block or unblock all listed machines, use the Block All or Unblock All buttons at the bottom of the page.
Related tasks
Searching Recent Activity
on page 181
Additional Policies on page 89
5.1.26 Policy & Content: Web Application Usage
By default, a chart and data table of the top web applications allowed today since midnight. The data table columns include Rank, Application & Feature, Hits (which displays a count of site visits) and Bytes (which displays the total bytes of uploads and downloads).
You can sort the results according to hits or the number of bytes consumed. The Chart parameter allows you to sort either by Top Applications or Top Features:
■ Top Applications shows a chart of the most used applications. The table below summarizes each application as well as showing a breakdown of each feature.
■ Top Features shows a chart of the most used features. The table below lists each feature with no grouping for their application.
The Status parameter allows you to filter results by Allowed, Blocked and Blocked (Application).
See Modifying Reports on page 167 for a description of the other parameters.
5.2 Modifying Reports
The reports about individual web appliances are available on a Management Appliance only.
On the right side of each report page is a Report Parameters sidebar with options for specifying the time period covered by the report and, sometimes, the kind of data that is displayed in the report. The options vary according to the type of report.
1. Set the desired parameters: a) Select an option for the Period that the report will cover.
■ Today: Only activity recorded since midnight for the current day is searched.
■ Yesterday: Only activity recorded during the previous calendar day (midnight to midnight) is searched.
168 | Reports | Sophos Web Appliance
■ Last: From the drop-down list, select a time increment for the report. Then, in the text box, enter a number specifying the time period (for example, 7 days). Partial minutes, hours, weeks, days, and months count toward the total number specified. Time frames are defined as follows:
— minutes: Any complete minutes within the specified span, plus the elapsed portion of the current minute.
— hours: Any complete hours within the specified span, plus the elapsed portion of the current hour.
— days: Any complete days within the specified span, plus the elapsed portion of the current day.
— weeks: This includes any complete weeks (starting on Sunday of the first week) that fall within the specified span, plus the current week, up to the current day.
— months: This includes any complete months (starting on the first day of the first month) that fall within the specified span, plus the current month, up to the current day.
■ Custom: Select the From and To date and time. Set the date by clicking on the calendar icon and selecting the date from the calendar pop-up dialog box.
b) If available, select the data that you want displayed. Certain options are available for specific reports only. The following is a complete list of Display options:
■ Appliance: [Management Appliance Only] This drop-down list appears on the Latency and Throughput report pages. You can generate the report on an individual joined appliance or All appliances.
Whether viewing the information for All appliances or for a specific Web Appliance, the time period covered is always based on the Management Appliance's time zone.
■ Category: Select a category on which to filter your results (for example, “Search Engines” or “Downloads”). You must a choose a category.
■ Report on a group: This drop-down list provides reports by department if you select a group or All Users. The groups displayed in the list are set on the Reports > Options >
Reporting Groups page.
■ Top n users: The number of users to display at once. If this number exceeds the number of users in your network, a complete list of users is displayed. The default is 25.
■ Top n sites: The number of sites to display at once. If this number exceeds the number of sites searched, a complete list of users is displayed. The default is 25.
■ Sort: The availability of these option buttons varies from one report to another. Some reports have none. If available, select one of the following to further refine the report data.
— Site visits: Ranks the results according to the number of visits to an individual website.
— Bytes consumed: Ranks the results according to the number of bytes downloaded from an individual website.
