Hi Ali,
HTTP being stateless will mean that you will see the time of the connection, but you will not be able to see the time spent on site unless there is a continuous call back. You can do something like this to show the time between the first and last seen event for a Source IP address
Thanks
Dan
------------------------------
Daniel
FortiSIEM Product Manager
------------------------------
-------------------------------------------
Original Message:
Sent: Dec 29, 2020 10:40 PM
From: Ali Haider
Subject: Duration of website visits
Hello All,
Is there a way to calculate the duration or time spent on a website by a user/Source IP.
This is more from an UEBA perspective and how productive our remote access users are (how evil I know).
BR,
Ali.
