Getting detailed URL info with Fortianalyzer

[NMBDave]

We are trying to get detailed information for where our users are going.  Say we have a user that goes to their facebook page and then to the company facebook page and then back to their own.  The detailed "User Detailed Browsing Log" only says they went to facebook.com.  Is there a way to see more details that might show if they are doing company business or personal?

[NMBDave]

So nobody has a way to get detailed info?

[emnoc]

Qs:

What/Where is the company Facebook page located at? Do you have SSL decryption so you can track the URL request in the http headers

[hzhao_FTNT · Accepted solution]

Make sure you can see webfilter logs in log view, then try:

select from_dtime(dtime) as timestamp, catdesc, hostname || url as website, cast(action as text) as status from $log-webfilter where $filter and hostname is not null  group by dtime, catdesc, website, action order by dtime desc

[MikePruett]

These days you pretty much have to enable SSL inspection to get a lot of the info you are looking at. Otherwise it just shows as SSL Traffic in general. Be prepared though, your logs will skyrocket haha.

[NMBDave]

Thanks everyone.  I'll check some settings and see what we get.  It is a shame so many won't just work at work.