Your firewall can also (likely) dump activity onto a SYSLOG server. There are 3rd party SYSLOG server services available for NT. You will also need some way of "analysing" these data. I like WebTrends Firewall, which ships with a SYSLOG service.
A better approach is to setup a Proxy inside your firewall. MS Proxy v2 is surprisingly good for this. WebTrends as an analysis tool, again. Point all of your browsers to the proxy, and block all but the proxy server from making outbound connections at the firewall so as to force your users to use the proxy.