PA SSL-decrypt pcaps

[BigPalo]

Hi,

I would like to know by security / audit issues if the captures that are made automatically when detecting a threat on encrypted traffic are stored encrypted or decrypted. So, PA is storing pcaps when enable ssl-decrypt about this traffic?

[BigPalo]

This is the example. In threats, we can see the pcap in plain text. So PA is keeping the pcap in plaintext?? we need to confirm for security audit reasons.

[reaper]

hi @BigPalo

The pcaps are stored on the firewall's harddrive unencrypted

The filesystem, however, is not accessible unless by authorized accounts