topic Re: Encryption Visibility Engine - where are the logs? in Network Security

Encryption Visibility Engine - where are the logs?

ryan14 — Thu, 16 Jun 2022 14:13:16 GMT

Where do I go to enable columns related to the Encryption Visibility Engine? In version 7.2 the documentation states to view information related to EVE, you must enable the columns but I cannot find where to do that. Anyone know where to enable this?

Re: Encryption Visibility Engine - where are the logs?

Marvin Rhoads — Thu, 16 Jun 2022 15:51:31 GMT

Go into the Table View of connection events and then click the X on any column. That will bring up the dialog box to enable or disable columns where you will see the EVE-specific columns.

FMC EVE Event Columns

Re: Encryption Visibility Engine - where are the logs?

ryan14 — Thu, 16 Jun 2022 20:17:14 GMT

Thanks, is there any way to keep them permanently selected or do you have select the columns every time?

Re: Encryption Visibility Engine - where are the logs?

Marvin Rhoads — Fri, 17 Jun 2022 03:30:29 GMT

Unfortunately they have to be selected every time in the GUI.

You can build a report with just the columns you want and then run it to get a static display of the interesting events.

Re: Encryption Visibility Engine - where are the logs?

Temur Kalandia — Tue, 02 Jul 2024 07:06:11 GMT

hello,

is it possibel to enable Encrypted Visibility Engine from cisco FDM ? i have only one FTD2110 without FMC

Re: Encryption Visibility Engine - where are the logs?

Marvin Rhoads — Tue, 02 Jul 2024 08:17:08 GMT

@Temur Kalandia no it is not currently possible (as of version 7.4). EVE Currently requires FMC (either on-premises or cloud-delivered).

Re: Encryption Visibility Engine - where are the logs?

Temur Kalandia — Tue, 02 Jul 2024 08:25:56 GMT

hi,

how can i see whats inside QUIC traffic ? it means that without FMC there is no chance to have such visibility ?

Re: Encryption Visibility Engine - where are the logs?

Marvin Rhoads — Tue, 02 Jul 2024 16:23:23 GMT

EVE does not replace SSL decryption. Instead it gives some ability to inspect an SSL/TLS-protected flow by discerning what it can from things like the SSL handshake. That's very different from decrypting and inspecting the encrypted payload. Even with SSL decryption you need to force fall back to http/2 to disable QUIC (or block udp/443).