https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/ai-visibility-with-on-premise-ngfw/m-p/1264086#M660 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/56396">@ChrisShopp</a>&nbsp;,</P> <P>&nbsp;</P> <P data-path-to-node="8,0">The biggest blind spot with monitoring AI traffic is encryption. Standard App-ID and URL filtering will catch the initial domain handshake, but since almost every AI provider uses HTTPS, all the payload details are hidden inside the encrypted tunnel.</P> <P data-path-to-node="8,1">To see prompt contents, API payloads, or file transfers, you’ll need to set up SSL Decryption. Once decrypted, you can layer on tools like Enterprise DLP to alert on or block sensitive data moving into those tools.</P> <P data-path-to-node="8,1">&nbsp;</P> <P data-path-to-node="8,1">Best,</P> Thu, 10 Sep 2026 11:49:05 GMT kiwi 2026-09-10T11:49:05Z https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/ai-visibility-with-on-premise-ngfw/m-p/1263870#M658 <P>Looking for recommendations or best practice items for monitoring/searching for AI usage through on-premise NGFWs.&nbsp; Standard app-id/URL classifications already being used, but is there anything else that might help or make things more visibile?</P> Tue, 08 Sep 2026 14:43:21 GMT https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/ai-visibility-with-on-premise-ngfw/m-p/1263870#M658 ChrisShopp 2026-09-08T14:43:21Z https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/ai-visibility-with-on-premise-ngfw/m-p/1264086#M660 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/56396">@ChrisShopp</a>&nbsp;,</P> <P>&nbsp;</P> <P data-path-to-node="8,0">The biggest blind spot with monitoring AI traffic is encryption. Standard App-ID and URL filtering will catch the initial domain handshake, but since almost every AI provider uses HTTPS, all the payload details are hidden inside the encrypted tunnel.</P> <P data-path-to-node="8,1">To see prompt contents, API payloads, or file transfers, you’ll need to set up SSL Decryption. Once decrypted, you can layer on tools like Enterprise DLP to alert on or block sensitive data moving into those tools.</P> <P data-path-to-node="8,1">&nbsp;</P> <P data-path-to-node="8,1">Best,</P> Thu, 10 Sep 2026 11:49:05 GMT https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/ai-visibility-with-on-premise-ngfw/m-p/1264086#M660 kiwi 2026-09-10T11:49:05Z