Insight, without decryption
Getting visibility into encrypted traffic can seem impossible, but by ignoring it, you provide attackers an ideal hiding place. The Encrypted Traffic Collection turns network data flows into rich evidence and useful insights—without decryption—so you can understand and mitigate risk. Combining observable elements, like timestamps and packet sizes, with known behavior of protocols, the ETC offers a practical approach to visibility that lets you see and act on what matters. It also avoids the heavy financial, privacy, and performance costs of decryption. Read more on the blog.
Corelight Collections are detection sets included with your Corelight subscription and can be activated depending on your needs.
- Find advanced attacks hiding in encrypted traffic
- SSL, SSH, RDP, DNS, and VPN visibility
- Highlight misconfigurations that expose data
- No decryption required
How it works
The Encrypted Traffic Collection offers unique insights into SSL, SSH, RDP, DNS, and VPN connections, along with top encrypted insights from the Zeek® community like JA3/S, HASSH—all without decryption. It employs Zeek to analyze the timing, sizes, flow direction, and other characteristics of network traffic, and integrates the results into Corelight’s comprehensive suite of evidence and analytics.
