diff --git a/debian/changelog b/debian/changelog
index 9c1ec83..1270bf4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+securityonion-web-page (20141015-0ubuntu0securityonion27) precise; urgency=low
+
+  * securityonion-web-page: add groupby:site to ELSA HTTP SQL Injection query #775 
+
+ -- Doug Burks <doug.burks@gmail.com>  Sun, 12 Jul 2015 07:34:26 -0400
+
 securityonion-web-page (20141015-0ubuntu0securityonion26) precise; urgency=low
 
   * securityonion-web-page: add SSL Top Subjects query #767 
diff --git a/debian/patches/securityonion-web-page:-add-groupby:site-to-ELSA-HTTP-SQL-Injection-query-#775 b/debian/patches/securityonion-web-page:-add-groupby:site-to-ELSA-HTTP-SQL-Injection-query-#775
new file mode 100644
index 0000000..3303213
--- /dev/null
+++ b/debian/patches/securityonion-web-page:-add-groupby:site-to-ELSA-HTTP-SQL-Injection-query-#775
@@ -0,0 +1,36 @@
+Description: <short summary of the patch>
+ TODO: Put a short summary on the line above and replace this paragraph
+ with a longer explanation of this change. Complete the meta-information
+ with other relevant fields (see below for details). To make it easier, the
+ information below has been extracted from the changelog. Adjust it or drop
+ it.
+ .
+ securityonion-web-page (20141015-0ubuntu0securityonion27) precise; urgency=low
+ .
+   * securityonion-web-page: add groupby:site to ELSA HTTP SQL Injection query #775
+Author: Doug Burks <doug.burks@gmail.com>
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: http://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: <YYYY-MM-DD>
+
+--- securityonion-web-page-20141015.orig/elsa/menu.php
++++ securityonion-web-page-20141015/elsa/menu.php
+@@ -178,7 +178,7 @@ function showhide(tspan, tri) {
+ 	<a href="<?php echo $h1; ?>class=BRO_HTTP BRO_HTTP.mime_type=java-archive groupby:site"	<?php echo $h2; ?>>Sites hosting JARs</a><br />
+ 	<a href="<?php echo $h1; ?>class=BRO_HTTP BRO_HTTP.mime_type=x-rar groupby:site"	<?php echo $h2; ?>>Sites hosting RARs</a><br />
+ 	<a href="<?php echo $h1; ?>class=BRO_HTTP BRO_HTTP.mime_type=zip groupby:site"	<?php echo $h2; ?>>Sites hosting ZIPs</a><br />
+-	<a href="<?php echo $h1; ?>class=BRO_HTTP &quot;HTTP::URI_SQLI&quot; &quot;URI_SQLI&quot;"	<?php echo $h2; ?>>Potential SQL Injection</a><br />
++	<a href="<?php echo $h1; ?>class=BRO_HTTP &quot;HTTP::URI_SQLI&quot; &quot;URI_SQLI&quot; groupby:site"	<?php echo $h2; ?>>Potential SQL Injection</a><br />
+ </span><br />
+ 
+ <!-- 'Intel' ELSA Queries -->
diff --git a/debian/patches/series b/debian/patches/series
index bc1afab..0ff76f6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -18,3 +18,4 @@ fix-HTTP-mime-type-queries-for-new-ELSA
 add-ELSA-queries-for-JARs-and-ZIPs
 add-HTTP-Potential-SQL-Injection-query
 securityonion-web-page:-add-SSL-Top-Subjects-query-#767
+securityonion-web-page:-add-groupby:site-to-ELSA-HTTP-SQL-Injection-query-#775
diff --git a/elsa/menu.php b/elsa/menu.php
index 9ba2dfb..f1b0311 100644
--- a/elsa/menu.php
+++ b/elsa/menu.php
@@ -178,7 +178,7 @@ function showhide(tspan, tri) {
 	<a href="<?php echo $h1; ?>class=BRO_HTTP BRO_HTTP.mime_type=java-archive groupby:site"	<?php echo $h2; ?>>Sites hosting JARs</a><br />
 	<a href="<?php echo $h1; ?>class=BRO_HTTP BRO_HTTP.mime_type=x-rar groupby:site"	<?php echo $h2; ?>>Sites hosting RARs</a><br />
 	<a href="<?php echo $h1; ?>class=BRO_HTTP BRO_HTTP.mime_type=zip groupby:site"	<?php echo $h2; ?>>Sites hosting ZIPs</a><br />
-	<a href="<?php echo $h1; ?>class=BRO_HTTP &quot;HTTP::URI_SQLI&quot; &quot;URI_SQLI&quot;"	<?php echo $h2; ?>>Potential SQL Injection</a><br />
+	<a href="<?php echo $h1; ?>class=BRO_HTTP &quot;HTTP::URI_SQLI&quot; &quot;URI_SQLI&quot; groupby:site"	<?php echo $h2; ?>>Potential SQL Injection</a><br />
 </span><br />
 
 <!-- 'Intel' ELSA Queries -->