The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
When users search for restricted keywords using a secure (HTTPS) search engine, search term alerts are not sent to the admin. Also, the activity is not logged in the Web Appliance reports. Eg. 'Reports | Users | Users By Search Queries'
First seen in Sophos Web Appliance WS1100
Logging for HTTPS transactions is not configured to show the complete URL. To analyze search terms, the web appliance must be able to see the complete URL within the HTTPS traffic.
In order for search term alerts to work with SSL search engines, HTTPS scanning must be enabled.
Note - When using HTTPS Scanning it is important to trust the Sophos generated Certificate Authority in your users' browser.
Also, the appliance must be configured to show the complete URL for HTTPS transactions. When the user visits a HTTPS site this will show the complete, decrypted HTTPS url in your logging and reports.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.