Advanced search. Watchguard XCS

Monitor your WatchGuard XCS

HTTP history search

Web requests and sessions can be searched using the following fields:

There is no message details for successful web sessions. However, the browse time for successful sessions is indicated in the status column of the search results.

ƒ Client IP — Searches web requests and sessions based on the IP address of the web client, such as

10.0.1.100

.

ƒ Request ID — Searches on the Request ID that is the unique identifier added to the request by the system, such as

8290352619373D0

. This field can also be used to search web sessions.

ƒ URL — Searches on the URL of the HTTP request, such as www.example.com

. This field can also be used to search web sessions.

ƒ Request From — Searches on the user name of the originating client request if authentication is enabled for the Web Proxy. If authentication is not enabled, use the Client IP option to search requests for specific client IP addresses. This field can also be used to search web sessions.

ƒ Virus — Searches for messages that contain the specified virus.

ƒ Spyware — Searches for messages that contain the specified spyware name.

ƒ Attachment Type — Searches on the attachment type of any attachments filtered by the Attachment

Control and Content Scanning features. The specified search term must match the Content-type for the attachment, as displayed in the HTTP log. For example, to match a .exe attachment, you must enter a partial or exact search on the Content-Type name of application/x-msdos-program

.

Advanced search

Click the Advanced Search link to expand the number of options to use for searching the database. The advanced search includes additional parameters such as advanced date ranges, message direction, TLS status, and the final action taken on messages.

User Guide 423