Users Web report

You are right, there are no detail-level reports, and the IView reporting application has the same problem.   

The logs actually have a great deal of useful information, but can be tricky to parse.   If you have a tool like Splunk, or any tool that handles syslog-format files well, use it to parse the logs.

I did not have access to Splunk, so I built my own solution, initially using Microsoft Access, later using SQL.

The description of my SQL solution is here

https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/100770/how-to-using-a-sql-database-to-interpret-utm-log-files

My perspective on using the web logs to evaluate "Acceptable Use" is in this link.   The first post discusses the problem, the final post is how I solved it.

https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/92864/evaluating-acceptable-use-browsing

You are right, there are no detail-level reports, and the IView reporting application has the same problem.   

The logs actually have a great deal of useful information, but can be tricky to parse.   If you have a tool like Splunk, or any tool that handles syslog-format files well, use it to parse the logs.

I did not have access to Splunk, so I built my own solution, initially using Microsoft Access, later using SQL.

The description of my SQL solution is here

https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/100770/how-to-using-a-sql-database-to-interpret-utm-log-files

My perspective on using the web logs to evaluate "Acceptable Use" is in this link.   The first post discusses the problem, the final post is how I solved it.

https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/92864/evaluating-acceptable-use-browsing