Technical Tip: How to Download 'PCAP' files in encrypted and ZIP format

[Ramy]

Description	This article describes how to set packet capture (PCAP) files to download from FortiAnalyzer encrypted and/or in ZIP format. This feature has been added to FortiAnalyzer Starting from release v7.4.1.
Scope	FortiAnalyzer/FortiManager (FortiAnalyzer Feature enabled).
Solution	In the FortiAnalyzer CLI, set the pcap-file download mode to zip-with-password: config system log pcap-file     set download-modezip-with-password{plain | zip | zip-with-password} <----- Alternative options. end In the FortiAnalyzer GUI, go to Log View and 'double-click' a log containing an archive file. In the Data section, select the download icon for the Archive field. The file is downloaded and the password is displayed in the FortiAnalyzer GUI. Copy the password, as needed to decrypt the archived Zip file. To unlock the downloaded file, the previously saved password must be used. Note: Archive contents should be enabled in FortiGate to reflect on FortiAnalyzer logs.            Related article: Technical Note: How to archive content of all emails passing through a FortiGate