Using Whois lookup

Note

When using the Filter tab, you must click the Apply button at the bottom left of the Filter tab each time you add or modify a filter. This applies the new or modified filter to your NDR search query.

1. Click and from INVESTIGATION, select Search.

2. Click the Filters tab to add and apply an HTTP filter to your packet search.

3. Click the Add Component button at the bottom of the dashboard and select the Event Table widget.

4. Click Add Component to save the widget to your dashboard.

5. Click the search icon, next to the Query Bar, to run the search.

6. Click the Column button at the top of the Event Table.

7. Select column fields that contain URL values (for example, httpHost) to display in the Event Table.

8. Click a particular httphost field and select Whois Lookup from drop-down menu. Information about the DNS owner is displayed.