Reporting on Specific Website Visits with Fastvue Reporter

While Fastvue reports- including Internet Usage, Safeguarding, and IT Network and Security reports- will give you valuable insights into which sites are being browsed and which videos are being watched on your network, sometimes you may want to drill down further on visits to a specific website, such as YouTube or CNN. 

Or perhaps you want to get a list of users that accessed a specific page on a website, such as: https://www.reddit.com/r/nsfw/

Fastvue Reporter slices each part of a URL into different fields. Let's use the following URL as an example:

https://www.reddit.com/r/dadjokes/search/?q=knock+knock

But… there is one more very special field: Origin Domain.

Origin Domain stores the result of Fastvue's Site Clean engine, which groups individual URLs into the domain a person was intentionally browsing. For more information, see our Site Clean page. Generally speaking, this is the field you want to use to find information about specific websites, such as who visited them.

You can select any of these fields when filtering reports or alerts to show information about specific websites, pages, queries, search terms, or sites hosted in specific countries using Fastvue Reporter.

Note: In order for your firewall to log the full URL as above, you need to ensure Deep Packet Inspection (also known as SSL decryption or HTTPS inspection) is enabled on your firewall. Otherwise, it will only log https://www.reddit.com and exclude the details about someone searching ‘knock knock’ on the dadjokes subreddit! 

Filtering reports by websites

To get started, click the Reports tab and click your desired report type. If you're unsure, try the Overview > Internet Usage report. See our article where we explain the different types of reports here. 

Next to the date pickers, there is a Filter button. Click this to open the Filters interface. Note that the Filters interface is already open when selecting Activity Reports. 

To filter a report by a specific website:

1. Click the Field drop-down and select Origin Domain from the list of fields.

2. For most common purposes, the Operator to select is 'Equal to', however, you also have 'contains', 'starts with', and more.

Click into the Values edit box and enter the domain of the website you want to filter. Do not include sub-domains here. For example, enter youtube.com, not www.youtube.com. You can enter multiple website domains into this edit box if required.

Click Run report to see the results! The report will be filtered just by the website(s) you have selected. 

Other Website Filter Options

Fastvue Reporter also provides other options for reporting on various parts of a URL. Click the Field drop-down menu and type Site to filter the list of fields to just the 'Site'- related fields.

And don’t forget about the two URL fields when you need them:

Referrer Fields

These fields are repeated for Referrer URLs as well (e.g., Referrer Domain, Referrer URL with Query, etc). Don’t sleep on Referrer fields! These are often the fields you want to use in your filters to report on all activity to a website’s page, as they’ll also give you all the images and other resources that get ‘pulled in’ when visiting a page, regardless of the domain they’re served from.

For example, Referrer Resource is handy when you want to report on all activity on specific web pages, such as /r/nswf/ on reddit.com. If you use Site Resource ‘Equal to’ /r/nsfw, this will not match much traffic due to the images and resources on the page not being hosted on that domain or path. However, their referrer URL will be set to the page the user is visiting.

Note - Using Referrer Fields will only work if you have Deep Packet Inspection enabled. Without DPI, your firewall will not log the Referrer URL for HTTPS websites at all!

Some Filter Examples

Report on all hits to reddit.com, including images and resources hosted on Reddit’s content delivery networks (CDNs) such as Redditstatic.com

Origin Domain ‘Equal to’ reddit.com

Note that the Origin Domain field does not include the subdomain:

Origin Domain Equal to 'www.reddit.com’'  // Will not work

Origin Domain reddit.com // Works

Report on just hits to reddit.com without including images and resources hosted on Reddit’s content delivery networks:

Site Domain ‘Equal to’ reddit.com

Report on visits to images.google.com

Site ‘Equal to’ images.google.com

(Site Domain or Origin Domain will not work in this case as they don’t include the images. part of the url)

Report on only people going to the ‘dad jokes’ sub-reddit:

Origin Domain Equal to 'reddit.com’'

AND

Referrer Resource Equal to '/r/dadjokes/`

Alternatively, you could use the Referrer URL field with the Contains operator:

Referrer URL Contains 'reddit.com/r/dadjokes';

Report on specific search terms that people have entered into Reddit:

Origin Domain Equal to reddit.com

AND

Search Terms Contains 'knock’'

Report on all searches on Reddit that contain a vowel (all searches)

Origin Domain Equal to 'reddit.com’'

AND

Search Terms Contains a,e,i,o,u

Report on all searches on Reddit that match a keyword group

Origin Domain Equal to 'reddit.com’'

AND

Search Terms In Keyword Group a,e,i,o,u

To include searches on any site, such as Bing, Google, or Amazon, just remove the Origin Domain filter from the above example:

Search Terms Contains a,e,i,o,u

The Site Country field resolves the site's top-level domain (TLD), such as .us, .uk, .au, into an actual country name, such as the United States, United Kingdom, Australia. To report on all sites ending in .au, you could therefore use:

Site Country Equal to 'Australia'

Alternatively, you could use:

Site Domain Contains '.au'

Sites ending in .com will have the Site Country of 'Unknown'.

Site Country Equal to 'Unknown' // All .com sites and other sites that do not have a country-specific TLD

With the information above, you should now have the knowledge you need to create an effective filter to report on exactly what you need to see.

If you have any specific filtering requirements you're unsure how to achieve, please get in touch!