topic Filename capturing not working... in General Topics

Filename capturing not working...

Crash28 — Thu, 30 Jul 2015 20:11:01 GMT

Hi everyone,

Is it possible to capture filenames as they are uploaded to dropbox, box.com, justcloud.com, etc...?

We "should" be decrypting the traffic according to our decryption policy. Well it at least shows the flag decrypted in the packet capture. But.....I'm not seeing the filename anywhere. We'd like to know who transferred what to where and when for cloud storage. Is this possible?

Please and thanks,

Mark

Re: Filename capturing not working...

Gregoux — Fri, 31 Jul 2015 11:34:36 GMT

hello

your security policy is configured may be with service application default. may be when you decrypted the the session the flow stop to match you policy because you tried to catch the application name on the 443 port and now the traffic is not seen as SSL.

be sure that you create asecurity policy which match the good app on the good tcp port like 443, and apply on it the security profile which handle the file blocking action.

regard's

Re: Filename capturing not working...

pankaku — Fri, 31 Jul 2015 11:51:22 GMT

Set the action for the URL category of Dropbox as alert and also try creating a file blocking profile and set the action as alert. Apply that file blocking profile to the security policy. Then check the traffic, URL filtering logs.

Rate the helpful answers

Re: Filename capturing not working...

Crash28 — Fri, 31 Jul 2015 21:10:11 GMT

Thanks guys, that's exactly what I was looking for. The filetypes were excluded from the outbound file blocking profile rule so it was never triggered.

Much appreciated!!!!