WebTitan uses the configured authentication method to determine the names of users that connect to it.  The "anonymous" user is used when an unauthenticated user accesses a site.  The most common use of this is when a user accesses a site that has been whitelisted bypassing authentication, or bypassing authentication and filtering.

Due to the fact that authentication is being bypassed, the user name cannot be determined so all access is logged as anonymous.