web usage report filtering negative

Question

Today my CEO asked to generate a monthly report about general usage of the Internet. 
 
 I'm working on SG125 with OS 9.601-5

As we are working with Office365, the top sites shown are hopefully related to Microsoft.com, sharepoint.com ..... but there is so much normal activity we have to go deep in the list to find what is not normal professional behavior. 
 
 I thought I could use the Filter option to select elements which are not normal but only manage to select positive filtering and not negative. 
 
 i.e. : 
 - I manage to select "facebook.com" which list only facebook activity 
 - I manage to select "twitter.com" which list only twitter activity 
 - I cannot exclude "Microsoft.com" so I get facebook, youtube and any other "non professional" website... but all on a same list without Microsoft.com related activity 
 
 Is there any kind of regular expression I need to know to filter by exclusion? 
 
 Thanks for your feedback.

DouglasFoster · Answer

Bandwidth is your best statistic for usage. HTTPS-without-Inspection counts sessions, and includes total bandwidth used during the session. HTTP and HTTPS-with-isnpection will count pages, including bandwidth used for the page. See the two types of entries can only be combined using the bandwidth measure. 
 I would start with bandwidth used by Category. Then you can look at hostnames-by-category or users-by-category when he asks "Why do we have so much bandwidth used for Social Networking?"