Generate Real-Time Reports  

Reports > Real-time Reports

Depending on the amount of data being analyzed (and your system hardware), generating a real-time report can take several minutes. The data generated to create a real-time report is not saved, but an archive of the report can be made by exporting to a PDF or CSV (comma separated value) file.

• Time Period—Choose the time interval for which you want to generate a report.

• Report by—The options available depend on the user ID method specified in the Administration > IWSVA Configuration > User Identification | User Identification page. For example, if you identify users by IP address rather than LDAP, user names will not be included in the report. MORE>>
  You can generate a report for one or more individuals or for one or more groups. When you select Specific user(s), only the Individual User Reports reporting parameters are active. In this case, IWSVA creates only individual reports.

  If you choose All users, "Individual user reports" will not be available. If you choose Specific user, all report types other than "Individual user reports" will be unavailable.

  If you choose All groups or Specific groups, you can only select the following report types:

  • Most violations by group

  • Most blocked URL categories

  • Most blocked Applets and ActiveX objects

  • Most blocked URLs

  • Most blocked URLs by day of the week

  • Most blocked URLs by hour

  • Most monitored URLs

  • Most warned (including warned and continued) URLs

  • Most monitored URL categories

  • Most warned (including warned and continued) URL categories

• Generate Report by Protocol—Generate a report based on the protocol used for the connection.

• Report type—For each report parameter, you can specify how many records you want to include in reports. For each report type, the default includes records like: the top number of users, URLs, categories, and so on, for each report type. Specifying a very large number, such as 99, will affect report size and generation time.
  
  The Top Categories (weighted) reporting parameter provides information about URL categories, even ones that are blocked or monitored. Also, this parameter provides the number of requests of every URL category and URL visited. This information can help you determine which URL category needs to be blocked or monitored for different Internet groups.

Under "URL Filtering Category Report" the Select URL Categories ... link allows you to select one main or sub category to generate reports. Report information can include the specified number of top active/monitored users or URLs in each category.

For the Most popular sites by user, Most blocked URL categories by user, Most monitored URL categories by user, Most blocked URLs by user, Most monitored URLs by user, and Most warned (including warned and continued) URL categories by user reporting parameters, the following conditions apply:

• The user can be an address, username, or host name.

• For HTTP, URL addresses include the whole address, not just the top-level domain. For HTTPS, URL addresses include only the top-level domain.

• Content is listed by most frequently visited URLs  specified by the user, and sorted by number of visits.

For Web Reputation, anti-pharming, and anti-phishing, blocked sites show up in the following reports because the information is logged in the URL Blocking Log that is used to generate reports:

• Most blocked URLs

• Most blocked URLs by day of the week

• Most blocked URLs by hour

The URL activity by user reporting parameter provides the URL activity (allowed, blocked, monitored or warned) for a single user. Management can review this activity and then determine if requests are permissible.

IntelliTrap is used in real-time reports to detect potentially malicious code in real-time, compressed executable files that arrive with HTTP data.

• Note:
  1) To accumulate data for Traffic report, you must first enable Log HTTP/HTTPS/FTP access events in the Logs > Log Settings | Reporting Logs screen.
  
  2) Cleanup Reports require the installation of the Damage Cleanup Services (DCS) component and the registration of IWSVA and DCS at Administration > IWSVA Configuration > Register to DCS.

• Options

• Chart type—Totals are presented in numerical form; data can also be represented with the following graph types: Bar, Stacked Bar, and Line. Choose Stacked bar to contrast blocked and unblocked traffic, and/or HTTP versus HTTPS URLs.

• Distinguish blocked from unblocked traffic—Choose this option to have IWSVA break-out user data in the report to show hits on blocked sites versus hits on unblocked sites. This option only applies for Consolidated and Blocking-event reports.

• Note:
  1. The Distinguish blocked from unblocked traffic option only applies to the Most active Users, Most popular URLs, and Most popular downloads reports.
  2. To distinguish blocked from unblocked traffic, you must first enable "Log HTTP/FTP access events" in the Logs > Log Settings screen and allow time for the distinguished data to accumulate.

See also

• Export Logs and Reports to Excel

• Customization Settings