In R80.10 SmartEvent, there's a standard view called "Active Users" that will show you this information (top users and how much data they've consumed plus apps they consumed it with).
In my case, I had to modify it to use Source IP instead of User (not using UserCheck at home).
I did a copy/paste of that table into a new report.
Or you can create the table easily enough (replace "Source" with "User" in this screenshot):
To get the files transferred, you may have to enable Content Awareness (and use R80.10 Gateways).
Bookmarks