KB Article | Forcepoint Support

Problem Description

How do I run a detailed Investigative Report?

Resolution

This article provides how-to instructions for common Investigative Reports functions. For complete information on Investigative Reports, click the Help button in TRITON Manager. 

Run an Investigative Report by date and view details

To run an Investigative Report by date and view details:
  1. Open TRITON Manager.
  2. Click the Web tab.
  3. On the left side of the page, click the Main section to open it.
  4. Click Reporting, and then click Investigative Reports.
  5. On the Internet Use by drop-down list located on the left side of the page, select Day.
  6. Use the Measure drop-down list at the upper right side of the page to select the data option you want to use for this report.
  7. Use the View drop-down list to choose the report timeframe.
  8. Click the Display Results button.
  9. To display the Detail View, click the Measure value, such as the Browse Time (in hh:mm:ss format).
    ​​User-added image
Note: If user account names are not displaying in reports, you may need to populate the Display Name field in Active Directory.
If you are using DC Agent and user account names are not displaying, see KB Article #8798 - DC Agent cannot retrieve user data after Windows update.

Customize and save a detailed Investigative Report

To customize and save a detailed Investigative Report:
  1. Generate a detailed report using the instructions above. Click the Measure value to open the Detail View.
  2. To customize the columns shown on the report, click Modify Report at the upper left. Add or remove columns, and then click Submit.
  3. Use the Select report type option to toggle between Summary or Detail view.
  4. To save the detailed report, click the PDF or XLS icons in the upper right.
    ​​​User-added image

Add a detailed Investigative Report to your favorite reports

To add a detailed Investigative Report to your favorite reports:
  1. Generate a detailed report using the instructions above. Click the Measure value to open the Detail View.
  2. On a detailed report, click Favorite Reports.
  3. Type a new report name, or use the default one provided.
  4. Click the Add button or link.

Schedule a favorite report

To schedule a favorite report:
  1. Generate a detailed report using the instructions above. Click the Measure value to open the Detail View.
  2. On a detailed report, click Favorite Reports.
  3. In the list of reports, click the report to schedule, and then click Schedule.
  4. For details on scheduling options, click the Help icon in the upper right corner.

Run an HTTPS protocol report

To run an HTTPS protocol report:
  1. Open TRITON Manager.
  2. Click the Web tab.
  3. On the left side of the page, click the Main section to open it.
  4. Click Reporting, and then click Investigative Reports.
  5. On the Internet Use by drop-down list located on the left side of the page, select Protocol. You should see HTTP and HTTPS listed.
    User-added image
  6. On the report, click the HTTPS link to open view options. Click an option to view details. For example: 
    • Select the by User option. This shows user visits to HTTPS websites. If the user has not logged on the domain or is not identified by name, the report shows the user's IP address.
    • For a more detailed report, click the number of Hits for a given user. 

Create a User Activity Detail by Day report

The User Activity Detail by Day report gives a more in-depth view of a specific user’s activity on one day.
 
To create a user activity detail report by day:
  1. Open TRITON Manager.
  2. Click the Web tab.
  3. On the left side of the page, click the Main section to open it.
  4. Click Reporting, and then click Investigative Reports.
  5. Click the User by Day/Month link at the top left of the Investigative Reports page.User-added image
  6. In the Search field, enter a user name or partial string, and then click Search.
    User-added image
    Results are listed in the Select user list of up to 100 matching user names from the Log Database.
  7. On the Select user list, click the user to investigate.
  8. Use the Select day field to choose the activity date. You can type the date directly into the field or click the calendar icon to choose a date.
  9. Click Go to User by Day. The report displays a timeline of the user’s activity in five-minute increments. Each request displays an icon corresponding to a Master Database category.

Create User Activity Detail by Month report

After you create a User Activity Detail by Day report, you can view monthly activity for the selected user. To create a user activity detail report by month:
  1. Follow the instructions to create a user activity detail report by day.
  2. Click User Activity Detail by Month at the top right of the report.
    User-added image
    The monthly report displays daily activity in calendar format, with colored blocks corresponding to internet activity for that day.
    User-added image
    You can click Database Category Legend at the top left to view the risk color key. These category assignments are fixed and cannot be changed. See the category mapping section of your deployment guide.User-added image
  3. Click the Prev or Next links in the upper right to view user activity for other months.

Article Feedback



Thank you for the feedback and comments.

Want 24/7 Tech Support?

Learn more