SSL Decryption Auto Tag URL to No Longer Decrypt

[Adam_DiMarco]

Hi,

I am working to get SSL decryption built in our environment.  I have policies I want to start with.

NoDecrypt_ByDestination (add sites as needed to dst and has NoTLSDecrypt-grp)

NoDecrypt_BySource

NoDecrypt_ByCategory (financial-gov-health-legal and custom URL Object Do-Not-Decrypt)

TLS_Decryption - actual decrypt rule

What I'd like to see about doing if a user connects to a site/URL that can't be decrypted or fails for ANY reason. That it will then add destination or dst URL to a DAG (NoTLSDecrypt-grp) .  That DAG group is in the NoDecrypt_ByDestination.  I am thinking of accomplishing this by log forwarding profile with custom filter and built-in-action.

I am ware the way this would work:

1. is user would first go to site and it fail when it hits the decryption rule.

2. LogFwd built-in-action is triggered and dest tagged and in NoTLSDecrypt-grp

3. user then retries URL and it is bypassed by hitting NoDecrypt_ByDestination rule.

Has anyone configured something like this?  This way sites that fail we could periodically audit what has been tagged.

Looking for guiance specifically on the buit-in acitons and what to filter for in the threat logs or decryption logs for events were decryption failed.

Any help pictured appreciated.

Thanks,

Adam D