Thanks Pavan,
That's pretty much as far as I got, although it doesn't give me individual connection times.
I extracted that by exporting the Association History from the GUI.
Not ideal, especially with European GDPR legislation that states I need to be able to provide all data stored about a subject.
Also, the application data per user is in there somewhere because you can drill down in the GUI under Traffic Analysis, but I can find no way to identify all traffic types for a particular user.
Appreciate your input though. :)