HTTPS Traffic Decryption

[crazyeman]

I want to be able to decrypt HTTPS traffic and monitor for specific keywords in the servers response. From what I understand, Intelligent Proxy can do this, is that correct?

Additionally, I've seen that Intelligent Proxy is deprecated? is that only for the MSP version? https://docs.umbrella.com/deployment-msp/docs/enable-the-intelligent-proxy

Will this still be available for the SIG packages?

[Konstantinos9]

Hello Crazyeman,

Intelligent proxy is totally automatic, works only with the DNS Policy, it will choose what destinations to proxy. You can't choose which domains or categories will go through the Intelligent Proxy, and the only exceptions you can make are based on Content Categories. Also it won't allow you to setup any advanced inspection controls other than File Analysis.

If you want to be able to decrypt all HTTPS traffic, then you need to look into SIG licensing. That way you can proxy all web traffic, decrypt it and apply more advanced inspection controls. The link that you shared is only for MSP accounts.

It's not clear what exactly do you need to monitor in server response.

Kind regards,
Konstantinos

[Ken Stieers]

And to follow on, if you're looking for specific terms in the web traffic, you need DLP