How do I run a detailed Investigative Report?

This article provides how-to instructions for common Investigative Reports functions. For complete information on Investigative Reports, click the Help button in Forcepoint Security Manager (Formerly known asTRITON Manager). 

• Run an Investigative Report by date and view details
• Customize and save a detailed Investigative Report
• Add a detailed Investigative Report to your favorite reports
• Schedule a favorite report
• Run an HTTPS protocol report
• Create a User Activity Detail by Day report
• Create User Activity Detail by Month report
• Create investigative reports for a specific time range

Run an Investigative Report by date and view details

To run an Investigative Report by date and view details:

1. Open Forcepoint Security Manager.
2. Click the Web tab.
3. On the left side of the page, click the Main section to open it.
4. Click Reporting, and then click Investigative Reports.
5. On the Internet Use by drop-down list located on the left side of the page, select Day.
6. Use the Measure drop-down list at the upper right side of the page to select the data option you want to use for this report.
7. Use the View drop-down list to choose the report timeframe.
8. Click the Display Results button.
9. To display the Detail View, click the Measure value, such as the Browse Time (in hh:mm:ss format).

Customize and save a detailed Investigative Report

To customize and save a detailed Investigative Report:

1. Generate a detailed report using the instructions above. Click the Measure value to open the Detail View.
2. To customize the columns shown on the report, click Modify Report at the upper left. Add or remove columns, and then click Submit.
3. Use the Select report type option to toggle between Summary or Detail view.
4. To save the detailed report, click the PDF or XLS icons in the upper right.

Add a detailed Investigative Report to your favorite reports

To add a detailed Investigative Report to your favorite reports:

1. Generate a detailed report using the instructions above. Click the Measure value to open the Detail View.
2. On a detailed report, click Favorite Reports.
3. Type a new report name, or use the default one provided.
4. Click the Add button or link.

Schedule a favorite report

To schedule a favorite report:

1. Generate a detailed report using the instructions above. Click the Measure value to open the Detail View.
2. On a detailed report, click Favorite Reports.
3. In the list of reports, click the report to schedule, and then click Schedule.
4. For details on scheduling options, click the Help icon in the upper right corner.

Run an HTTPS protocol report

To run an HTTPS protocol report:

1. Open Forcepoint Security Manager.
2. Click the Web tab.
3. On the left side of the page, click the Main section to open it.
4. Click Reporting, and then click Investigative Reports.
5. On the Internet Use by drop-down list located on the left side of the page, select Protocol. You should see HTTP and HTTPS listed.

6. On the report, click the HTTPS link to open view options. Click an option to view details. For example: 
   • Select the by User option. This shows user visits to HTTPS websites. If the user has not logged on the domain or is not identified by name, the report shows the user's IP address.
   • For a more detailed report, click the number of Hits for a given user. 

Create a User Activity Detail by Day report

The User Activity Detail by Day report gives a more in-depth view of a specific user’s activity on one day.
 
To create a user activity detail report by day:

1. Open Forcepoint Security Manager.
2. Click the Web tab.
3. On the left side of the page, click the Main section to open it.
4. Click Reporting, and then click Investigative Reports.
5. Click the User by Day/Month link at the top left of the Investigative Reports page.
   
   

 

Create User Activity Detail by Month report

• In the Search field, enter a user name or partial string, and then click Search.
  
  
• Results are listed in the Select user list of up to 100 matching user names from the Log Database.
• On the Select user list, click the user to investigate.
• Use the Select day field to choose the activity date. You can type the date directly into the field or click the calendar icon to choose a date.
• Click Go to User by Day. The report displays a timeline of the user’s activity in five-minute increments. Each request displays an icon corresponding to a Master Database category.

After you create a User Activity Detail by Day report, you can view monthly activity for the selected user. To create a user activity detail report by month:

1. Follow the instructions to create a user activity detail report by day.
2. Click User Activity Detail by Month at the top right of the report.
   
   
   
   The monthly report displays daily activity in calendar format, with colored blocks corresponding to internet activity for that day.

3. You can click Database Category Legend at the top left to view the risk color key. These category assignments are fixed and cannot be changed. See the category mapping section of your deployment guide.

4. Click the Prev or Next links in the upper right to view user activity for other months.

Create investigative reports for a specific time range

1. Access Investigative Reports and click either the number representing "Hits" or the red bar after the Hit number. A Detail View report appears.
2. At the top of the Detail View window, an option to modify the time displayed is available as shown below. After selecting a time range, click the chevron to see the new data appear

3. If the column for Time is not shown, click Modify Report. This allows for adding or removing columns shown in reports. The Time column is only available in Detail reports

Keywords: detailed investigative report; save investigative report; customize investigative report; schedule report; protocol report; user activity detail report