SourceFire search for individual URL

[nickalleyne]

Hi there,

We are in the process of deploying SourceFire, and I have been requested to try out two particular features for reporting/searching.  We just upgraded to 6.0.0.0 if that makes a difference.

Basically what we want to find are the following:

1) Enter a user, and find all URLs/IPs they accessed

2) Enter a URL, and find all users who accessed that URL (ideally over a specific timeframe)

I have been trying for the past few hours, but cannot get either of those to work properly.  Any ideas?

Thanks in advance,

[Aastha Bhardwaj · Accepted solution]

Hi,

Try Searching in Analysis>Connections , click on Edit search , search of Initiator IP and then search for it .  For URL, on the left search TAB you have URL option.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

[nickalleyne]

Thank you,

After further research, it seems that the issue I am having is actually due to 6.0 not doing proper user authentication.  I have opened a case with support, which has been escalated to development, so hopefully they have an answer.