What is a proxy log?¶

A proxy log records activity handled by a proxy service that sits between a user or device and another service, often the web.

For an investigator, the key issue is that the proxy is an observation point. It sees and records what passes through it according to its configuration.

Avoid this assumption: That a proxy log is a complete record of everything a user accessed online. It may not be.

A proxy log can record details such as the source account or device, requested domain or URL, destination address, action taken, response code, data transferred, category, user agent and timestamp. This may help show that a device or account requested access to a particular web resource.

But the record may reflect only traffic that was routed through that proxy. Direct connections, mobile data, VPN traffic, encrypted applications or unmanaged devices may bypass it. Where HTTPS inspection is not used, the proxy may see only the domain or connection metadata rather than the full page path or content.

A recorded request does not automatically prove that a person viewed the material. Background processes, browser prefetching, adverts, embedded content, synchronisation and malware can all generate requests. A successful status may mean the proxy permitted the request, not that the user read or interacted with the destination.

Investigators should establish whether the proxy was explicit, transparent, cloud-based or built into a security service. Ask how users and devices were identified, whether authentication was required and whether URL paths were visible. Preserve the original export, field definitions, relevant configuration and surrounding entries.

Correlate significant entries with DNS, firewall, endpoint, browser, authentication and server-side records. Avoid presenting a domain request as proof of a deliberate visit without supporting evidence.

Operational takeaway¶

A proxy log records traffic observed through one intermediary, but coverage, encryption, automation and user attribution determine what the entry can safely support.