KB Article | Forcepoint Support

Notes & Warnings

Internet Browse Time is not based on:

  • When the user's browser is open or closed
  • Bytes sent
  • Bytes received
  • Bytes transferred (this information is based on the size of the files that are downloaded from that site)
  • Duration (which is the amount of time it takes to download the files)
If you see 00:00:00 reported for individual hits, then an embedded link may have been hit once and therefore no browse time captured for that site was recorded. If you are seeing 00:00:00 for “all” browse time, then it is possible that the SQL IBT job has not run yet or that Forcepiont is not receiving information from the integration, for example a PIX or ASA.

Problem Description

How does Internet Browse Time Reports work and what data do they contain?

Resolution

Calculating a user's Internet browse time is challenging, because it is difficult to determine whether the user is actually reading the page, just opening or closing the browser, performing another task in a different application with the browser open, or possibly away from the desk entirely with the browser open.

Forcepoint software makes a reasonable approximation of Internet browse time (IBT) based on:

  • timestamps from Internet requests made as the user browses Web sites
  • the (configurable) Read Time Threshold
  • the (configurable) Last Read Time

Forcepoint reporting tools combine Internet requests into sessions. A session includes all Internet requests from a particular user where the time between any two requests is less than the Read Time Threshold (3 Minutes by default).

Reporting tools calculate the time from the first request of the session to the last. Then the Last Read Time is added to determine the Internet Browse Time.

A session is setup in the following format:
MM/DD/YYYY - Hour:Minute:Second  AM/PM - URL

For example, a user's browse time session may look like this:

5/6/2018 6:05:10 AM http://www.espn.com
5/6/2018 6:05:11 AM http://www.espn.com/index.html
5/6/2018 6:05:11 AM http://www.espn.com/banner.gif
5/6/2018 6:05:11 AM http://www.espn.com/soccer.gif
5/6/2018 6:05:11 AM http://www.espn.com/worldcup.gif
5/6/2018 6:05:30 AM http://www.espn.com/worldcup/outcomes.html
5/6/2018 6:05:31 AM http://www.espn.com/worldcup/2006.gif
5/6/2018 6:05:31 AM http://www.espn.com/worldcup/2007.gif

 
Actual user's behavior:

  1. The user opens the browser and types URL www.espn.com into their browser at 6:05:10 AM on 5/6/2008. 
  2. One second later, various html objects are downloaded for that URL. 
  3. The user looks at this page for 19 secs, and then clicks the link http://www.espn.com/worldcup/outcomes.html. 
  4. One second later, more objects are downloaded for that page.

Suppose the user reads this page, and then stops making any Internet requests for more than 3 minutes (the duration of the Read Time Threshold). Because this break is larger than the Read Time Threshold, the requests shown above are all considered part of one session.
 
To determine the total time for this session, Forcepoint software calculates the time from the first request (6:05:10 AM) to the last (6:05:31 AM), which is 21 Seconds. Then it adds the Last Read Time (3 Minutes by default) to that time, for a total of 3 Minutes 21 Seconds.

You can configure the Read Time Threshold and Last Read Time by:

 

  1. Log into Forcepoint Security Manager (Formerly TRITON Manager). 
  2. Click Settings.
  3. Click Reporting.
  4. Click Log Database

A new session is created for the next group of Internet requests made by the same user. This includes having multiple web pages open at the same time. If one webpage is open to Facebook and another webpage is open to YouTube, then these are two different sessions and will be calculated separately. They will not be grouped together into one session.

In addition to using the concept of a session, the IBT calculation excludes data collected for categories that generate a lot of superfluous Internet usage data and for protocols other than HTTP and HTTPS.  Browse time calculations also exclude the records generated when a site has been blocked.  This is done in an attempt to make the calculated IBT values as accurate as possible. 

The categories currently not used for IBT calculations are:

•    * Productivity:  Advertising
•    * Miscellaneous:  Images (Media)
•    * Miscellaneous:  Image Servers
•    * Miscellaneous:  Private IP Addresses
•    * Miscellaneous:  Content Delivery Networks
•    * Miscellaneous:  Dynamic Content
•    * Miscellaneous:  Network Errors

Also, the filters for reports defined to show IBT do not include the categories, protocols or actions that are not used for IBT calculation.  This is also the case when a Browse Time report is used to define a new report.  When a predefined IBT report is selected for editing, the filters are limited to the categories, protocols and actions used for IBT calculation. 

 

Article Feedback



Thank you for the feedback and comments.