NSM Reports - Understand Productivity Report

In Executive Summary, the summary metrics are combined results for all users/IPs/connections, etc. For example in the screenshot (from a weekly report), Total Data Transferred is 2 years 9 months. This is all network traffic being aggregated. It includes local users (if SSO is configured and users are logged), or network devices like Windows computer, etc. On Windows computer, there may be multiple applications running simultaneously, with or without user logging in. Each application may have one or more session connecting to the Internet. 

When no local users are configured in the Firewall, it results in all network traffic being aggregated as User=Unknown. This aggregation can significantly distort reported usage metrics. In real-world deployments, a significant portion of traffic consists of service-to-service or machine-to-machine communications that do not involve human browsing behavior. For example, we observed multiple internal clients with distinct source IP addresses communicating with kinesis.us-west-2.amazonaws.com, a managed data streaming endpoint provided by Amazon Web Services. These sessions represent automated data ingestion workflows rather than human-initiated browsing.

To address the aggregation issues, we are adding Initiators (Source IP) as an additional grouping option in the Productivity Report → User Dashboard. Web activity will now be categorized by:

• User
• Initiators/Source IP
• User + Source IP (combined view) 

Additional Context in PDF Reports: To provide clarity on the factors contributing to Total Session Time, the PDF report now includes:

• Count of Unique Users
• Count of Unique Source IPs

These metrics are essential for interpreting the aggregated session duration, especially in environments where:

• No local users are configured on the Firewall
• Traffic is consolidated under "User = Unknown"
• Web activity is driven by multiple internal hosts or automated services

By explicitly presenting the number of distinct users and source IPs, the report will help customers quickly determine whether a high Total Session Duration is the result of:

• A small number of users with long sessions, or
• Many users or hosts contributing shorter or overlapping sessions

These corrections improves transparency and prevents misinterpretation of aggregated session metrics in both human-driven and machine-to-machine traffic scenarios.

• Accurately interpret automated workload traffic
• Distinguish between human activity and background services
• Gain precise visibility into total network session utilization

SonicWall continues improving the reports and making more enhancements.