View and Customize the Activity Search Report

This topic explains the functions of the Activity Search report and where to find the report in Secure Access.

Table of Contents

• Prerequisites
• View the Activity Search Report
• Customize the Activity Search Report

1. Time Frame
2. Customize Columns
3. Filter Request
4. Additional Filters
5. Search Options

• Save Activity Search Report columns and filters for future use

Prerequisites

• A minimum user role of Read-only. For more information, see Manage Accounts.

View the Activity Search Report

1. Navigate to Monitor > Reports > Activity Search. This takes you to the default view of the Activity Search report, which lists all of your identities and the internet requests or traffic events for your organization, tracked over time.

2. Hover over individual column values to apply it as a search filter or to exclude it from the search.
3. To learn more about individual results, click the blue ellipsis View Actions icon to the right of each search result. For more information, see View Activity Search Report Actions.

Customize the Activity Search Report

1. Choose a time frame to view the report. The default is Last 24 Hours. The maximum is Last 30 Days.

2. Customize Columns to select columns to display, drag and drop to reorder column position, then click Apply.

3. Filter Request by selecting an option from the dropdown menu at the top right. Filters and columns update to those that are relevant to the selected Request type. The default Request type is All.

4. Search and select additional Filters to the left of the report results. For the complete list of filters and options, see the table below.

Choose from the following filters and options. Filter options available in this menu are determined by the Request selected in the previous step.

Note: Filters apply a logical OR relationship between options, except in the case Event Type. Selecting more than one Event Type option will not return results because the Event Type filter applies a logical AND relationship between options.

For example, if you filter for both the Public Application and Destination List event types, the Activity Search report will not return any results because an event can have only one event type.

For all other filters, selecting some or all options can return results. For example, if you filter for both the HTTP and HTTPS protocols, the Activity Search report will return all web events because they will have used either the HTTP OR HTTPS protocol.

Filter	Filter options
Response	Allowed Blocked Blocked PDNS The Response filter applies a logical OR relationship when you select more than one option. Optionally, you may apply one or both advanced options to the Allowed event filter: Allow: All events that were allowed by passing through your security policies. For Web Policies, this will include the Allow-Security enforced action. Security Overridden: Identities will be permitted to access destination even if we detect a security issue. This action will only appear on activity associated with Web Policies.
Warn Page Behavior	Warned Accessed After Warn The Warn Page Behavior filter applies a logical OR relationship when you select more than one option.
Isolate	Isolated events are browser-based security threats that were redirected to a Secure Access cloud-based host. For more information, see About Isolated Destinations.
IPS Signature	Log Only Would Block Block The IPS Signature filter applies a logical OR relationship when you select more than one option.
Protocol	HTTP HTTPS The Protocol filter applies a logical OR relationship when you select more than one option.
Event Type	Public Application Destination List Any Security Category Any Content Category Cisco AMP Disposition is Malicious Antivirus Disposition is Malicious Integration Tenant Controls Certificate and TLS Errors Data Loss Prevention Geolocations The Event Type filter applies a logical AND relationship when you select more than one option and will return only one type of event.
Identity Type	The type of source in the Rule Identity column. Identity Type options vary by event and by organization. The Identity Type filter applies a logical OR relationship when you select more than one option.
Decryption Actions	Decrypt Inbound Decrypt Outbound Do not Decrypt Decrypt Error The Decryption Actions filter applies a logical OR relationship when you select more than one option.
Security Categories	For the full list of filter options, see Threat Category Descriptions. The Security Categories filter applies a logical OR relationship when you select more than one option.
Content Categories	For the full list of filter options, see Available Content Categories. The Content Categories filter applies a logical OR relationship when you select more than one option.

5. Select Search Options below the Filters menu in the previous step.

• Include All Traffic— Includes data from all domains including noisy domains that are filtered out by default.
• Filter by Uncategorized— Includes destinations that are not classified under a specific security or content category.

Save Activity Search Report columns and filters for future use

• Once you select a filter on a new search, a Save Search button will appear. Configure filters and customize columns, then click Save Search.
• Review search filters applied to this search, then click Continue.

• Review customized columns selected for display for this search, then click Continue.

• Search name is required and Description is optional. Once you Save, you will be able to access and update your customized report from the Saved Searches dropdown at the top right of the report.

---

Activity Search Report < Activity Search Report > View Firewall Events in Activity Search Report