web_query report is not finding a specific http address

Products

• Security Analytics

Issue/Introduction

When trying to search for a specific http address, the web_query report is not finding the address even though it was captured on the Security Analytics appliance.

Resolution

The web_query attribute is an index of search queries that were sent to various search engines (bing, facebook, google, msn, wikipedia, yahoo, youtube, etc).

If you are searching for web/http transactions with particular domains, then you might have better luck with queries with the http_server or http_uri attributes.

For example, this curl command:  

curl -k 'http://www.google.com/search?q=my+search+query'

produces the following web_query result:

Try using http_server or http_uri instead.