UTM 9 - AD users WebProtection stats

You can get better details if:

1) You use https inspection.  Without it, only the initial connect to a fqdn is logged, everything else is hidden and therefore not loggable.  With inspection, you get full urls for every request.

2) You develop your own tools for logging and reporting.  I found the supplied reports lacking because you could not drill down for details.

However, UTM sees all web requests, and 95 percentage of those are not things the user requested.  They are things the web page pulled in without his knowledge, or things the browser did for certificate verification, update checking, and other overhead.   This makes it difficult, but not impossible, to test employee behavior for compliance with acceptable use policies.  Know the limitations over your data

Don't forget that you can also use iview 3 for this. It's free although does have a storage limitation for larger deployments.

I've found that it's worthwhile as it has picked up patterns that would normally take a fair amount of trawling through logs etc

Don't forget that you can also use iview 3 for this. It's free although does have a storage limitation for larger deployments.

I've found that it's worthwhile as it has picked up patterns that would normally take a fair amount of trawling through logs etc