<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">As someone who just started sending decrypted traffic to Zeek, I recommend also installing MITRE’s bro-http2 (<a href="https://github.com/MITRECND/bro-http2" class="">https://github.com/MITRECND/bro-http2</a>) plugin, since you’ll find a lot of today's encrypted traffic is HTTP/2.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Aug 28, 2019, at 4:32 PM, Johanna Amann <<a href="mailto:johanna@icir.org" class="">johanna@icir.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Jonah,<br class=""><br class=""><blockquote type="cite" class="">When feeding PCAPs to Zeek, is there any functionality to decrypt <br class="">HTTPS traffic?<br class=""></blockquote><br class="">No, sorry, we don’t have that functionality.<br class=""><br class=""><blockquote type="cite" class="">I see that the SSL log contains “a record of SSL sessions, including <br class="">certificates being used” - can these certificates be used to <br class="">decrypt PCAPs before Zeek processes them to ensure HTTP logs are <br class="">correctly populated?<br class=""></blockquote><br class="">No, the certificates only contain the public keys, not the private keys.<br class=""><br class="">For the moment you will have to use other software to decrypt the <br class="">traffic in pcaps (if you have the pcaps and the keys of the sessions). <br class="">Wireshark has a bit of functionality to do this, for example.<br class=""><br class="">Johanna<br class="">_______________________________________________<br class="">Zeek mailing list<br class=""><a href="mailto:zeek@zeek.org" class="">zeek@zeek.org</a><br class="">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</div></div></blockquote></div><br class=""></body></html>