PCAP encryption
FortiNDR Cloud encrypts all captured and stored PCAP data using public key cryptography. To enable this feature, add a PEM‑encoded RSA key to the account on the Account Management page.
Enabling PCAP encryption prevents FortiNDR Cloud analysts from accessing the contents of captured packet data and renders the data unrecoverable if the private key associated with the uploaded public key is lost.
Generating a key
Be sure to only upload the contents of the public.pem file and keep the private.pem file safe. In the event that private.pem is lost, FortiNDR Cloud is unable to recover either it or the contents of any PCAP encrypted with the matching public key
For information about uploading a public key, see PCAP encryption keys.
Windows
To generate a key pair on Windows, we recommended using the PCAPUtil program. You can download the binary here or from the Settings inAccount management .
You must be logged in to FortiNDR Cloud to download the binary.
Generate a key pair with files named public.pem (public key) and private.pem (private key) in the current directory. PCAPUtil supports overriding all file names and locations via command line arguments.
bash pcaputil generate
macOS and Linux
Generate a public/private key pair using the built-in OpenSSL library.
bash openssl genrsa -out private.pem 4096 openssl rsa -in private.pem -outform PEM -pubout -out public.pem
Decrypting a PCAP
Unencrypted PCAP files are denoted with an extension of .pcap, and encrypted PCAP files are denoted with the extension .pcap.enc.
Windows
Encrypted PCAP files can be decrypted with the FortiNDR CloudPCAPUtil binary.
You must be logged in to FortiNDR Cloud to access this file.
pcaputil decrypt -private private.pem -src sen1-1502499443.pcap.enc -dst sen1-1502499443.pcap
macOS and Linux
Use the following script to extract and decrypt the PCAP:
#!/usr/bin/env bash
show_help () {
echo "Usage: $0 private_key encrypted_pcap decrypted_pcap"
}
if [ -z $3 ]; then
show_help
exit 0
fi
tar zxf $2
openssl pkeyutl -decrypt -inkey $1 -in session.key.enc -out session.key
#openssl rsautl -decrypt -inkey $1 -in session.key.enc -out session.key
key=$(xxd -p -c 96 session.key | cut -c 1-64)
iv=$(xxd -p -c 96 session.key | cut -c 65-96)
openssl enc -aes-256-cbc -d -in data -out $3 -nosalt -K $key -iv $iv
rm data
rm session.key
rm session.key.enc