View Web Events in Activity Search Report
The Activity Search report provides a detailed view of web events in your organization. For more information about the Activity Search report, see View the Activity Search Report.
Table of Contents
Prerequisites for Viewing Web Events
- A minimum user role of Read-only. For more information, see Manage Accounts.
Filter the Report by Web Requests
- Navigate to Monitor > Reports > Activity Search.
- Choose a time frame to view the report. You can view the results for the last 24 hours (default), Yesterday, Last 7 Days, Last 30 Days, or a Custom range.
- From the drop-down menu at the top-right of the table, choose the Web option to filter the report for Web events.
View Web Event Details
The Activity Search Report displays Event Details for each search result in a side panel.
- Click the ellipsis (...) and choose the View Full Details option to view web event details in the side panel.
- The Event Details appears in the side panel. For more information, see View Activity Search Report Actions.
Web Event Details Fields
Web event details include the following fields that are also available as Activity Search report columns. For more information about these fields, see View and Customize the Activity Search Report.
- Action
- Time
- Rule Name
- Source
- Rule Identity
- Internal IP Address
- External IP Address
- Destination
- Categories
- Resource/Application
- Application Category
- Content Type
- Request Method
- Referrer
- Status Code
Web event details also include the following fields that do not appear as Activity Search report columns.
| Field Name | Description |
|---|---|
| Hostname | Fully Qualified Domain Name (FQDN) of the machine or container from which the event originated. |
| File Action (Remote Browser Isolation) | Action taken on a file, such as Viewed, Original File Downloaded, Sanitized PDF File Downloaded. |
| Total Size in Bytes | The number of bytes sent from the client for the full requests, including HTTP headers (for example, 234). |
| User Agent | The user agent string as captured by the proxy (for example, "Mozilla 5.0 (X11; Linux x86_64; rv:12.0) Gecko 20100101 Firefox 21.0"). |
| SHA256 Hash | This represents the SHA-256 hash of the response body. |
| Egress IP Address | The IP address is used by the proxy to communicate with the origin server. Dot notation is used for IPv4 and RFC 5952 is used for IPv6 (for example, 1.2.3.4, 2001:db8::1). |
| Egress Data Center | The data center that processed the request. |
| YouTube Channels | The YouTube channel name, such as "@CiscoSystems" in the Cisco YouTube channel (https://www.youtube.com/@CiscoSystems). |
| YouTube Categories | The set of YouTube categories, such as Education, Entertainment, Animation. |
View Firewall Events in Activity Search Report < View Web Events in Activity Search Report > View Zero Trust Events in Activity Search Report
Updated 3 days ago