Web browsing history reporting

Question

How can we generate a report that details web sites that a specific user/computer has accessed?  We want to have a report on a daily or weekly basis that details any web site visits for a specific computer, including the times those sites were accessed.

Example:

Computer Name  IP Address         Web Site                    Time accessed  Date
PC115                 192.168.1.55    www.weather.com      9:25 AM         3/5/2012
PC318                 192.168.1.109  www.hotmail.com      10:33              3/5/2012

How can we generate a basic report like this?

jswan · Answer

You cannot do this with NetFlow because NetFlow doesn't capture the data in the HTTP header. You need the actual HTTP header because it is extremely common for web servers to host many sites at the same IP address; simple reverse DNS does not work for this type of tracking.

As mmelton stated, a web filtering appliance is the easiest way to get this data. If you want something free, look at httpry, but realize that with httpry a good bit of customization and scripting will be required to get exactly what you're asking for.

mmelton · Answer

Have your company purchase a Web Filter. Out of the box this will be something that can provide for you. Orion NTA isn't the best answer for Web Site reporting.

One thing you can do is on your Firewall, say if you are using a Cisco ASA is to ensure your logging is set to Information and that syslog 304001 is not disabled. This will then send website accesses as syslogs to the server. I warn you though that this will flood your syslog server and make life a pain. You probably won't be able to have much more insight beyond 30 minutes into employee activity this way either.