PCAP encryption

FortiNDR Cloud requires the encryption of all PCAP data captured and stored on the platform, backed by public key cryptography. Adding a PEM-encoded RSA key to an account on the Account management page will enable this feature.

Activation of the PCAP encryption feature prevents FortiNDR Cloud analysts from reviewing the contents of any captured packet data, and renders that data unrecoverable should the private key associated with the uploaded public key be lost.

Generating a key

Be sure to only upload the contents of the public.pem file and keep the private.pem file safe. In the event that private.pem is lost, FortiNDR Cloud is unable to recover either it or the contents of any PCAP encrypted with the matching public key

For instructions on how to upload the generated public key, see the Settings page.

Windows

To generate a key pair on Windows, we recommended using the PCAPUtil program. You can download the binary here or fromSettings (Account Management) in Account management.

You must be logged in to FortiNDR Cloud to download the binary.

Generate a key pair with files named public.pem (public key) and private.pem (private key) in the current directory. PCAPUtil supports overriding all file names and locations via command line arguments.

bash
pcaputil generate

macOS and Linux

Generate a public/private key pair using the built-in OpenSSL library.

bash
openssl genrsa -out private.pem 4096
openssl rsa -in private.pem -outform PEM -pubout -out public.pem

Decrypting a PCAP

Unencrypted PCAP files are denoted with an extension of .pcap, and encrypted PCAP files are denoted with the extension .pcap.enc.

Windows

Encrypted PCAP files can be decrypted with the FortiNDR CloudPCAPUtil binary.

You must be logged in to FortiNDR Cloud to access this file.

pcaputil decrypt -private private.pem -src sen1-1502499443.pcap.enc -dst sen1-1502499443.pcap

macOS and Linux

Use the following script to extract and decrypt the PCAP:

bash
#!/usr/bin/env bash
show_help () {
echo "Usage: $0 private_key encrypted_pcap decrypted_pcap"
}
if [ -z $3 ]; then
show_help
exit 0
fi
tar zxf $2
opessl rsautl -decrypt -inkey $1 -in session.key.enc -out session.key
key=$(xxd -p -c 96 session.key | cut -c 1-64)
iv=$(xxd -p -c 96 session.key | cut -c 65-96)
openssl enc -aes-256-cbc -d -in data -out $3 -nosalt -K $key -iv $iv
rm data
rm session.key
rm session.key.enc