SSL Decryption Auto Tag URL to No Longer Decrypt

Adam_DiMarco — Wed, 18 Oct 2023 15:44:52 GMT

Hi,

I am working to get SSL decryption built in our environment. I have policies I want to start with.

NoDecrypt_ByDestination (add sites as needed to dst and has NoTLSDecrypt-grp)

NoDecrypt_BySource

NoDecrypt_ByCategory (financial-gov-health-legal and custom URL Object Do-Not-Decrypt)

TLS_Decryption - actual decrypt rule

What I'd like to see about doing if a user connects to a site/URL that can't be decrypted or fails for ANY reason. That it will then add destination or dst URL to a DAG (NoTLSDecrypt-grp) . That DAG group is in the NoDecrypt_ByDestination. I am thinking of accomplishing this by log forwarding profile with custom filter and built-in-action.

I am ware the way this would work:

1. is user would first go to site and it fail when it hits the decryption rule.

2. LogFwd built-in-action is triggered and dest tagged and in NoTLSDecrypt-grp

3. user then retries URL and it is bypassed by hitting NoDecrypt_ByDestination rule.

Has anyone configured something like this? This way sites that fail we could periodically audit what has been tagged.

Looking for guiance specifically on the buit-in acitons and what to filter for in the threat logs or decryption logs for events were decryption failed.

Any help pictured appreciated.

Thanks,

Adam D

Re: SSL Decryption Auto Tag URL to No Longer Decrypt

TomYoung — Wed, 18 Sep 2024 17:09:17 GMT

Hi @Adam_DiMarco ,

I am surprised no one responded to this post. Here is a video how to do it.

https://www.youtube.com/watch?v=WgG6Hi0T73g

Thanks,

Tom

Re: SSL Decryption Auto Tag URL to No Longer Decrypt

Adam_DiMarco — Fri, 04 Oct 2024 14:20:17 GMT

Thanks Tom, exactly what I was looking for. Appreciate it. Still working to build up our SSL Decryption across our network.

topic Re: SSL Decryption Auto Tag URL to No Longer Decrypt in General Topics

SSL Decryption Auto Tag URL to No Longer Decrypt

Re: SSL Decryption Auto Tag URL to No Longer Decrypt

Re: SSL Decryption Auto Tag URL to No Longer Decrypt