Technical Tip: How to Download 'PCAP' files in encrypted and ZIP format

1. In the FortiAnalyzer CLI, set the pcap-file download mode to zip-with-password:

config system log pcap-file

    set download-modezip-with-password{plain | zip | zip-with-password} <----- Alternative options.

end

2. In the FortiAnalyzer GUI, go to Log View and 'double-click' a log containing an archive file.

3. In the Data section, select the download icon for the Archive field.

The file is downloaded and the password is displayed in the FortiAnalyzer GUI. Copy the password, as needed to decrypt the archived Zip file.

To unlock the downloaded file, the previously saved password must be used.

Note:

Archive contents should be enabled in FortiGate to reflect on FortiAnalyzer logs.
          

Related article:

Technical Note: How to archive content of all emails passing through a FortiGate