how to see specific users web traffic or domains visited ?

[cyberops123]

I am trying to figure out how to check for specific users internet browsing history in Cisco ironport s170 .

we get time to time phishing emails and when we do investigation we want to make sure if end user clicked on the link that comes in the email and  or directed to different malicious websites . 

I used third party cloud based proxy and I was able to filter for any user for specific time period and pull out all the websites they visit . Let me know if anyone can help me on this 

Thanks 

[Handy Putra]

Hi,

You can pull out a report from Web Tracking report.

From web tracking, you can enter the user or client IP address on certain time range and also filter based on websites, or transaction types (allow, block, etc).

And if you click on "Advanced" link you can make further filter.

Web tracking is in GUI -> Reporting -> Web Tracking -> Proxy Services tab

Another way is that to check the actual raw logs from CLI (called accesslogs)

You can do  "grep" command and select accesslogs number and put your user or client IP address as the regular expression to list out what sort of traffic that user requesting.

Regards

Handy Putra