— hours: Any complete hours within the specified span, plus the elapsed portion of
the current hour.
— days: Any complete days within the specified span, plus the elapsed portion of the
current day.
— weeks: This includes any complete weeks (starting on Sunday of the first week) that
fall within the specified span, plus the current week, up to the current day.
— months: This includes any complete months (starting on the first day of the first
month) that fall within the specified span, plus the current month, up to the current
day.
■
Custom: Select the From and To date and time. Set the date by clicking on the calendar
icon and selecting the date from the calendar pop-up dialog box. Set the time by
positioning the cursor beside the hour, minute, or AM/PM setting, and using the up and
down arrow buttons to select a time.
b) Enter the User or Site for which you want to search.
■
If you chose to search By User, enter the username or user’s IP address that you want
information on, and select a Filter. If your Web Appliance is configured to access a
stand-alone Active Directory server, enter the username that you want to search on; if
the Web Appliance is configured to access the global catalog of a multidomain Active
Directory forest, enter the username that you want to search on in the form
"domain\username".
Optionally, you can narrow the search results by selecting an individual status from the
Filter by status drop-down list. You can also enter a specific web site in the Filter by
site text box to view pages from that location that were viewed by the specified user.
■
If you chose to search By Site, enter the site name that you want information on; for
example,
domain.com/page.htm
.
You can also search by domain alone (e.g., "example.com"), and then refine your search
further after reviewing the results. Optionally, you can narrow the search results, by
selecting an individual status from the Filter by status drop-down list.
■
If you chose to search By Suspicious Activity, enter the username or user’s IP address
for which you want information. If your Web Appliance is configured to access a
stand-alone Active Directory server, enter the username that you want to search on; if
the Web Appliance is configured to access the global catalog of a multidomain Active
Directory forest, enter the username that you want to search on in the form
"domain\username".
Optionally, you can enter a specific web site in the Filter by site text box to view pages
from that location that were viewed by the specified user. You can also enter a reason
in the Filter by Reason text box to view results for a particular reason. Only exact
matches are supported in the Filter by Reason text box.
■
If you chose to search By User Timeline, results will group browsing within a domain
for a continuous amount of time. This will display the top level domain under Site, The
time range the user spent on the site under Time Frame, and the number of page
182 | Search | Sophos Web Appliance
