topic Re: Detect RC4 traffic in Strata Logging Service Discussions

Detect RC4 traffic

PMorendage — Wed, 17 Dec 2025 05:35:49 GMT

How do we detect RC4 traffic without decrypting using the Palo Alto toolset (NGFW, SCM, SLS, IoT, etc.)?

In SLS, I can currently filter down to:

Application Subcategory = 'auth-service' AND Application = 'active-directory-base'

However, there is no option to identify the use of weak ciphers (e.g., RC4).

Re: Detect RC4 traffic

TomYoung — Wed, 17 Dec 2025 22:15:44 GMT

Hi @PMorendage ,

You can identify weak ciphers with a decryption profile for non-decrypted traffic. Create a decryption rule with the action of no-decrypt and assign the decryption profile to it. Since you do not want to block weak ciphers at this time, allow everything.

https://docs.paloaltonetworks.com/network-security/security-policy/administration/objects/decryption-profile#create-a-decryption-profile-pm

When a lot of traffic runs through the decryption profile, you can use cool tools to analyze the traffic.

https://docs.paloaltonetworks.com/network-security/decryption/administration/troubleshooting-decryption/identify-weak-tls-protocols-cipher-suites#identify-weak-tls-protocols-and-cipher-suites-pan-os

After you have analyzed the traffic, you can choose to block weak certificates, ciphers, or protocols by unchecking the boxes in the decryption profile.

Thanks,

Tom

Re: Detect RC4 traffic

PMorendage — Thu, 18 Dec 2025 02:00:22 GMT

Thank you very much Tom , Let me test and get back to you