You want to identify or create a report based on the actual method (Basic, NT Lan Manager - NTLM or Kerberos) negotiated by clients for authentication.
A real time packet capture taken from proxy will indicate the authentication method ultimately selected by clients. But it is a tedious process to search this information in a capture for every user and a pcap buffer is typically too small to leave it running so it is not a viable option in networks with high volume of traffic. The best approach is to include the ELFF (Extended Log File Format) header "x-auth-credential-type" in the access-log.
After adding the field, the access-log will show as below.