Reporter 11 - show which rule a URL is being hit on using reporter

[JS_2022]

We have Reporter 11 running on our Mgmt center. I ran a report to see who hit a specific 'site' but I don't see how I can tell which proxy rule permitted it. Is that possible with Reporter?

[Lee Roth]

Do these steps:

1. Via VPM, for each rule in your User Web Access layer(s), create a "Policy ID" in the "Track" column.
   
   Create a unique Policy ID for each rule, (I used "Match_001" for the first one, increment the number for subsequent rule edits) and set the NAME and the VALUE for that policy ID to the same text - e.g. "Match_001" is the NAME, and "Match_001" is the VALUE of the Policy ID in the "Track" column.
   
   
2. Make sure the field name "x-bluecoat-reference-id" is one of the fields being written to the SGOS User Access logs that are going to be loaded/ingested by the Reporter package.
   
   The resulting field should have this name/value (example):
   
   x-bluecoat-reference-id    Match_083
   
   
3. If applicable... make sure that the field "x-bluecoat-reference-id" is defined as a Custom Field within Reporter.
   
   
4. Now, you should be able to generate reports using the field "x-bluecoat-reference-id".
   
   Also... while editing via VPM, you should be able to do a search for the desired "Match_<nnn>" text and locate the exact rule that you found when doing your reports/searches via Reporter.

It was about 10 years ago that we added this additional field when we were (then, pre-Reporter) simply pawing through User Access logs (using 'grep' or using a custom viewing/formatting script); we could then use VPM, and 'search' for the text to find the rule that matched.

-------------------------------------------