What is a proxy log?¶

A proxy log records traffic handled by an intermediary between an endpoint and another service. Its coverage is limited to traffic routed through it and fields visible under its encryption and inspection settings.

Requests do not equal deliberate viewing¶

Records can show account or endpoint, domain or URL, destination, action, response, bytes, category, user agent and time. Direct routes, mobile data, VPNs and unmanaged endpoints may bypass collection, while encrypted traffic may expose only domain metadata. Prefetching, adverts, embedded content, synchronisation and malware generate requests automatically.

Establish proxy mode and identity method¶

Determine whether explicit, transparent, cloud or security-integrated, whether authentication applied and whether paths or content were visible. Preserve configuration, fields and adjacent records.

Correlate DNS, firewall, endpoint, browser, authentication and server records before calling a request a deliberate user visit.