How need to configure to capture http_post on Facebook (chat, messages, posts on the walls)?
What I did:
1) went to Capture > Advanced Search, opened Content > selected Concept element, then typed Expression and in text field = facebook.com
But as result I saw smtp post, not http.
2) went to Capture > Advanced Search, opened Sender/Recipient , selected URL as faceebook.com AND in Protocol, selected HTTP_Post. As result - nothing found.
But before search, I posted on Facebook.
How are you handling SSL decryption? (does Monitor even deal with SSL? It think this is among the reasons many environments may skip it in favor of Prevent+explicit SSL middling proxy).
An awful lot (and in some configurations, all) facebook interaction is now done over SSL.