User Activity
The User Activity report shows how your users used the network in a period: who was active, how long their sessions were, and which events they caused, from access decisions to blocked uploads. Open it from Activity > Reports.
For AI traffic, use the AI Agent Activity report (every source) or the AI Usage report (the Netzilo AI Gateway).
User Activity reports contain sensitive information about user behaviour. Only administrators can open Activity; share downloaded PDFs with care.
Create a User Activity report
- Go to Activity > Reports and click Create Report.
- Select User Activity as the Report Type.
- Choose the Date Range. The default is the last two weeks.
- Optionally pick Groups to limit the report to their users. Leave it empty for all users.
- Click Save.
The report appears in the table when it is ready. Click the eye icon to view it, or the download icon to save it as a PDF. See Reports for the table and the dialog.
What the report shows
The top of the report summarises the period:
| Item | What it shows |
|---|---|
| Total Users | Users included in the report. |
| Active Users | Users with activity in the period, with their share of the total. |
| Average Session Time | The average session length of the active users. |
| Total Events | All events of the included users. |
| User Distribution | A pie chart of active and inactive users. |
| Event Distribution | Events per category: Access Control, Data Exfiltration, Policy Violation, Suspicious Activity and Administration. |
Below it, Users lists every user with their Session Time and Last Seen. Use Search for user activity to find a user.
Detailed user analysis
Click a user to expand their details:
| Section | What it shows |
|---|---|
| Event Distribution | The user's events per category, as a radar chart. |
| Devices | The user's devices by operating system: Windows, Linux, iOS, macOS and Android. |
| Daily Activities | Per day: session time, number of events and their categories. |
| Top Targets | The network targets the user accessed most, with counts. |
| Top Applications | The applications the user started most. |
| Top Web Sites | The sites the user visited most. |
| Top Blocked Sites | The sites that were blocked for the user, with counts. |
| Events per category | One table each for Data Exfiltration, Policy Violation, Suspicious Activity and the other categories, with Date/Time, Activity, Source and Target. |
Each top list holds up to 100 entries and fills only from the events your setup records:
- Top Targets from Target access granted events.
- Top Web Sites from Accessed URL events, by domain.
- Top Blocked Sites from Blocked URL events, by domain.
- Top Applications from Application started events in the Enterprise Workspace.
See Profiles for the protections that record these events.
Use the API
Create the report with POST /api/reports and "report_type":"user_activity". See
Reports.
Troubleshooting
A user shows no activity. The user had no events in the period, or is not in the selected groups. Widen the date range or clear Groups.
Top Web Sites and Top Blocked Sites are empty. No Accessed URL or Blocked URL events were recorded for the user in the period.
Related Documentation
- Reports - Create, view, download and delete reports
- Authentication Activity - Logins and failed logins
- AI Agent Activity - AI agents, tool calls and violations
- Events - The events behind this report
- Dashboard - Account overview and agentic activity