1. A method comprising: receiving, via a graphical user interface (GUI) of a network security device protecting a private network, a request from an administrator of the private network for a report to be generated from a log of network traffic observed by the network security device, the request containing information defining report parameters including one or more of (i) a specified time frame, (ii) user information indicative of one or more users associated with the private network; and (iii) application information specifying one or more particular applications or one or more types of applications associated with the logged network traffic; extracting from the log, by the network security device, information regarding logged network traffic satisfying the report parameters; presenting, by the network security device, via the GUI the report to the administrator, wherein the report includes (i) a plurality of network traffic items summarized by an administrator-selected report parameter of the report parameters; and (ii) a plurality of action objects each corresponding to one of the plurality of summarized network traffic items, wherein a traffic volume metric or a percentage of traffic volume metric displayed for each summarized network traffic item of the plurality of summarized network traffic items represents an aggregate of traffic volumes or an aggregation of percentages of traffic volumes, respectively, for each observed value of a primary report parameter of the report parameters within the extracted information for a value of the administrator-selected report parameter corresponding to the summarized network traffic item; and responsive to interaction by the administrator with a particular action object of the plurality of action objects and selection by the administrator of an action to be taken on subsequently received network traffic matching the corresponding summarized network traffic item of the plurality of summarized network traffic items, automatically defining, by the network security device, a security policy including one or more rules identifying the matching network traffic and a corresponding action to be taken on the matching network traffic based on the selection.