How can I track which users or IP addresses are accessing a certain website using AppFlow?

This article describes how to track which Users or IP addresses are accessing a certain website using AppFlow Monitor on Dashboard.

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

NOTE: Before following this KB, please ensure that AppFlow is enabled. [[Enabling the Real-Time Monitor and AppFlow Collection in SonicOS Enhanced|170503566814827]].

Login to your SonicWall management page and click on Monitor tab on top of the page.

1.  Navigate to AppFlow Logs|AppFlow Monitor page. Select 'Web Activity' tab and In Group by select Domain Name from drop-down list.
   
2. Click on the website you want to track and click Filter option. In this example we use the URL detectportal.firefox.com. 

     This will limit all the information under all the other tabs specific to detectportal.firefox.com.

     3. Click Users tab. It will show all the users who tried to access detectportal.firefox.com.

   Clicking on username shows the IP address.

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

NOTE: Before following this KB, please ensure that AppFlow is enabled. [[Enabling the Real-Time Monitor and AppFlow Collection in SonicOS Enhanced|170503566814827]].

Login to your SonicWall management page and click on Investigate tab on top of the page.

1.  Navigate to AppFlow Logs page. Select 'URLs' tab and In Group by select Domain Name from drop-down list.
   
   
   
2.  Click on the website you want to track and click Filter option. In this example we use the URL www.junk.com. 
   
   
   This will limit all the information under all the other tabs specific to www.junk.com.
   
   
   
3. Click Users tab.It will show all the users who tried to access www.junk.com.
   
   
   
4. Clicking on username shows the IP address.