If the Top Users sections of your reports and dashboards are only showing IP addresses instead of real usernames, this means that Sophos Web Appliance is not authenticating users.
Fastvue Sophos Reporter can only show usernames if they exist in the log data sent to the Fastvue server from the Web Appliance. This only happens when your Web Appliance is authenticating users.
To configure authentication on Sophos Web Appliance appliance, go to Configuration | System | Authentication | Default Settings and configure either Active Directory SSO (recommended) or Captive Portal authentication. For more information see Sophos's article on Configuring Authentication.
Once usernames are logged by Sophos Web Appliance, Fastvue Reporter can match them to their User object in Active Directory. You can then utilize other features such as Department and Security Group reporting.