Cisco CWS

I have asked this over at r/cisco and had no joy so thought I would ask here as there maybe someone who uses CWS.

Is anyone else using CWS and is good at using the reports?

I have ran a report and found a user that has a lot of blocks for pornography. This user has a written warning for looking at porn at work on a work device.

I see blocks against his domain user name but also blocks at separate times for his machine name, what does this mean? Is his machine doing something when he isn't logged in?

I need to be 100% sure that this user is still trying to access porn and it isn't something on his machine trying connections in the background.