In this case it's likely in the Session. You can *temporarily* create a rule in your System Profile -> <Agent Group> -> Sensor Configuration -> Servlets by adding a "Session Attribute" type parameter with "*" as the value. This may cause needless overhead, though, so once you've verified which attribute you are looking for you will want to be specific.
Once you turn this on, you can verify what info is being captured by looking at new PurePaths, right-clicking the first node in the PurePath Tree and getting Details.
Hope that helps,