topic Re: PA SSL-decrypt pcaps in General Topics

PA SSL-decrypt pcaps

BigPalo — Tue, 23 Oct 2018 06:58:40 GMT

Hi,

I would like to know by security / audit issues if the captures that are made automatically when detecting a threat on encrypted traffic are stored encrypted or decrypted. So, PA is storing pcaps when enable ssl-decrypt about this traffic?

Re: PA SSL-decrypt pcaps

BigPalo — Wed, 24 Oct 2018 08:52:18 GMT

This is the example. In threats, we can see the pcap in plain text. So PA is keeping the pcap in plaintext?? we need to confirm for security audit reasons.

Re: PA SSL-decrypt pcaps

reaper — Wed, 24 Oct 2018 11:53:57 GMT

hi @BigPalo

The pcaps are stored on the firewall's harddrive unencrypted

The filesystem, however, is not accessible unless by authorized accounts