H3C Technologies H3C SecCenter UTM Manager - Manual (Page 97)

89
Behavior auditing
The behavior auditing component analyzes audit logs received from managed devices, allowing you to
audit terminal user behaviors precisely based on enormous logs. You can audit user behaviors such as
which websites and when the user visits, which protocols are used, and which files are sent in Emails. The
component also allows you to audit website visits, and file transfer, Email, and instant messaging
applications. It supports using a variety of combinations of query options to track and audit user
behaviors.
To access the behavior auditing component, select the Behavior Auditing tab. Then, you can configure
the functions described in the following sections:
• User behavior analysis
• User behavior auditing
• Database auditing and analysis
• URL analysis
• Audit logs backup
User behavior analysis
The user behavior analysis module provides comprehensive website access analysis and Email
application analysis. The statistics information includes top N websites statistics and Email application
statistics. Exporting of reports is supported.
Website analysis
From the navigation tree of the behavior auditing component, select Websites under User Behavior
Analysis. The website analysis report page appears, as shown in
Figure 83 . The website analysis
function provides statistics on website visits and visitors, and displays the statistics in bar graphs and lists:
• The website ranking contrast graph displays the websites with the top number of visits in a bar
chart.
• The website ranking list lists the number of visits to each of the top N websites and the visit
percentage.
• The user ranking contrast graph displays the users who pay the most number of visits to the websites
in a bar chart.
• The user ranking list lists the number of visits of the top N users and the visit percentage.
Table 77 describes the website analysis query options.
CAUTION:
The data source of this function is HTTP logs of the managed devices. Make sure that UTM HTTP logging
is enabled on the devices.