IronPort WSA: Reports on HTTPS only sites

[Enam Rahman]

Hi, a customer just recently enabled IronPort WSA HTTPS proxy, and wants to get an idea of which sites their employees are accessing over HTTPS. I only setup a decryption policy for now, with nothing getting blocked. Is there a way to generate a report to see this list of sites? The L4TM reports shows multiple URLs per site, so it's not very easy to use. Thanks.

[Handy Putra]

Hi,

Unfortunately, WSA built in reporting tools is quite limited and it does not has any reporting to just showing what HTTPS websites access only.

The reporting that it has is either listed all websites being accessed (HTTP and HTTPS) or using the Web Tracking to do more filter (however there is no option to just showing HTTPS sites only).

If you want to get more granular and more options in term of reporting with WSA, would recommend to get Splunk third party reporting tool that will work with WSA appliance. Recommend to speak to your Cisco Sales Rep to get more info regarding Splunk Reporting.

Hope this helps,

Regards

Handy