Hello,

I have a situtation that I am trying to find solution to. My company, like many, is experiencing a tough time with the current economic climate. Unfortunately, we have had to lay some employees off, and this is a contributing factor to many employees resorting to anonymously posting very negative and libelous comments about the company. Senior management is convinced that these postings are coming from employees that are posting using company equipment on company time. We have used our existing web content filtering system to confirm that employees have visited the particular site from company networked PCs. However, I am unable to determine exactly what actions they are taking (what text they are actually posting).

Is anyone aware of any network based tools (not interested in installing client side software on a gazillion workstations) or creative techniques that I might use to determine what exactly is being posted? I do understand that I would only be able to monitor networks/systems under my companies control.

Thanks

cheap way:
sure plug a linux box with a big hard drive into the span port and create a tcpdump filter to capture everything from the workstations the suspected employees are using.

expensive way:
install netwitness

I agree with Apollo an IDS rule that triggers on posts would be the easiest and cheapest method.  You might also want to combine that with a string search based on your company name and variations.  That should give you a lot less false positives.

That's what an acceptable use policy is all about.  Note too, that as far as I'm aware, the laws between different countries vary considerable regarding how much monitoring is allowed, and whether or not the company has to have some just cause for doing a thorough audit of an employee's machine etc.
IDS rules won't be perfect.  You only have to look at spam filtering to see how limited machines can sometimes be at matching patterns etc without proper context!

Assuming you read the information from the other posters about legality and policly...

We use websense to monitor this. You can drill down and see the full url that was accessed. If someone posted on a certain blog you could search websense for access to that site and look at the url, specifically the url for posting.

If you set something like this up, save yourself the trouble and block those types of sites unless there is a solid business case for your company or department.