Using Advanced Search

The hours you want to search for connection activity. Slide the start and end to select a limited number of hours of the day in a 24-hour format to the nearest hour.

For example, limit the results to school hours or limit results to the hours of a specific class time. Selecting 6 and 16 would search for traffic between 6 am and 4:59 pm on the From Dates you specify.

The users you want to investigate. Start typing the unique letters in the user ID to filter the dropdown list. The list only displays users with data during the selected From Date, so you don’t search for connection data that is not present.

Check one or more usernames to filter the search to specific users.

The groups of users, such as students or year groups, you want to research. Start typing the name of the group to filter the dropdown list. The list only displays groups with data during the selected From Date, so you don’t search for connection data that is not present.

Check one or more group names to filter your results.

The filter status of the connection attempt. Limits the results to how the connection attempt was filtered: 

• Select Yes to display blocked connection attempts
• Select No to display allowed connections
• Show all results by checking both or leaving both  unchecked

The users’ version of Linewize Connect  (Chrome macOS or Windows). You can limit your results by the version of Connect installed on your users’ devices.

• Select the dropdown list and check one or more versions of Linewize Connect. Only versions of Connect running during your specified date range will be available.
• Leave this field blank to search for all versions of Connect.

The path is the text after a web address. May identify the page, path or web application. Narrow down your results by filtering one or more patterns in the website path. 

While you can select the path from the dropdown, we recommend using the conditional “Contains” or “Doesn’t Contain” to allow for other characters included in the website path as the user attempts to connect.

The IP address the user was attempting to connect to.

Search for one or multiple destination addresses by selecting the checkbox. 

You can type part of the IP address to limit the list of IP addresses you can select from.

The port (if used) at the destination.

Search from one or multiple destination ports by checking the listed ports. You can also type a port number to limit the ports you can select from.

For example, ports 443 and 1194 may be commonly associated with encrypted traffic or a specific VPN. Or, you may notice port 3389, a common port for a remote desktop connection.

The address of the computer inside the School Manager monitored network. 

Search for one or multiple source addresses by selecting the checkbox. 

You can type part of the IP address to limit the list of IP addresses you can select from.

The Filtering Policy applied to the connection attempt.

Select one or multiple Content Filtering Rules. 

You can type part of the Policy name to limit the items you can select from in your list.

A text and numeric code from Classwize allows users to access content typically blocked by a Filtering Policy. Limits the connection results to those made using the bypass codes you specify.

You can narrow down results by filtering one or more Bypass Codes. Select a search function from the dropdown and enter a Bypass Code. (See Classwize documentation for more information.)

The name of the parent content filtering Theme used to group connection attempts.

You can narrow your results down by selecting one or multiple Themes. The search results will be filtered to match the Theme you specify.

You can type part of the Theme name to limit the list of Themes you can select from.

The names of the content filtering Categories used within a Theme. Select a Category to organize content and allow for more granular filtering.

You can narrow your results to the connection attempts in the specified Categories.

You can type part of the name to limit the list of Category names you can select from.

The name of the website service, app, or application associated with the connection attempt.

Search from one or multiple Applications to separate allowed and suspicious activity. 

You can type part of the Application name to limit the list of Application names you can select from.

Application names can range from generalized, like “Education”, to specific, like “Khan Academy”.

The computer name on the network, such as the Windows Workgroup name. Blanks allowed. It may be used where a shared computer has multiple users, like a library or lab computer.

Search from one or multiple machine names. 

You can type part of the machine name to limit the list of names you can select from.

Type a word or phrase to see if a user has tried searching for the phrase.

Dropdown list with Checkbox (Text)

Reporting type is used to identify the source of the connection reported.

If the field is empty, the connection was reported by your Linewize appliance.

If the field says “Extension”, this means the connection was reported by Connect app or extension.

Returns only results that are an exact match to the end characters in the field.

Review the column in the Search results and match the last characters, including symbols like .ru or .kz

Returns only result where no characters are expected in the field and a blank was recorded. A blank is different from zero and null.

Not recommended for the Advanced Search. 

Use the number zero in number fields instead of blank. Fields like Website path will contain a slash / not a blank.

Returns only results where no data was recorded in the field. 

For example, tablets connected to the network typically do not have a Machine Name so the field would be null. You may combine the null Machine Name with the IP in the Source Address to find tablet connection results.

Excludes results with the pattern of characters anywhere in the field. 

Not case sensitive.

Excludes results with the pattern of characters at the beginning of the field. 

Not case sensitive. The characters, including symbols like the slash /, at the front of the string, must match.

Returns any results that contain any character or null data marker.

Not recommended. All records will be returned. All fields contain a slash, a zero or a null marker instead of a blank.

Deprecated.

Deprecated.

Contact our Linewize Support for complex searches.