Skip to main content
bascheew
bascheew
Visitor III
March 28, 2019
Solved

Report to show the top users (IPs) that have visited specific categories

  • March 28, 2019
  • 2 replies
  • 3783 views

Our client has asked for a report that would show a list of the top users (or IPs) that have visited specific web filter categories.  I do not see any of the system datasets that have the combination of these fields.  

 

It could be as simple as this:

 

User              Category             Count

10.0.0.3         Hacking                12

10.0.0.5         Proxy Avoidance    8

10.0.0.3         Proxy Avoidance    5

10.0.0.4         Discrimination       2

 

Thanks!

 

    Best answer by chutter_FTNT

    Hi,

    this should work:

     

    select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, catdesc, count(*) as sessions from $log where $filter group by user_src, catdesc order by sessions desc

     

    Regards

    Christian

     

    2 replies

    chutter_FTNT
    Staff
    chutter_FTNTAnswer
    Staff
    March 29, 2019

    Hi,

    this should work:

     

    select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, catdesc, count(*) as sessions from $log where $filter group by user_src, catdesc order by sessions desc

     

    Regards

    Christian

     

    stuart_smiles
    stuart_smiles
    New Member
    April 1, 2019

    What if you want to create a "cloud storage" category for a similar report, totalling user counts over a period of time, so can trend for growth of cloud adoption for apps, data transfer to storage/backup/similar sites, potentially even seeing bandwidth utilisation, traffic manage some storage sites or prioritise during time of day/ so can offer core, lunchtime and out of hours service levels for sites of interest/bandwidth hogs like facebook/instagram video etc, and feedback to users outside of guidelines on overuse, within the fortinet platform ala bluecoat and websense, whilst not blocking, perhaps "encouraging" wait to do it on "own internet" instead.

    Terms & ConditionsAccessibility statement