Security Action = userbrowsed

Hello,

I ran FortiClient reports in FAZ. The FortiClients are registered to EMS and do not have Web Filter enabled in the profile. Web Filter is enabled in the firewall only, and applied to the respected policies. In the reports, there are Web Filter violations with Action "userbrowsed" 

I could not find exactly what "userbrowsed" means, but to me it sounds like allowed/monitored? Anyone know this?

And how are Web Filter reports generated for the Forticlient when the Web Filter is off on the FortiClient?