> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/tls-interception.md).

# TLS Interception

Enginsight's TLS Interception feature allows you to decrypt encrypted network traffic locally on a host using the Enginsight agent Pulsar and analyze it for attack patterns with the Intrusion Detection System.

This means that the relevant network traffic does not need to be routed through a proxy or collected at another central location for analysis. The existing network infrastructure can remain unchanged.

{% hint style="warning" %}
**Please note**: The TLS Interception feature is currently supported only on Linux hosts.
{% endhint %}

***

## Requirements

**Using the TLS Interception Feature**

* The host on which TLS interception is to be used must have at least **4 cores** and **4 GB of RAM** available. A [supported Linux operating system](/docs/manual/english/installation-and-configuration/system-requirements/pulsar.md#supported-operating-systems-pulsar) must also be installed.
* The service to be analyzed using TLS interception must use **OpenSSL** or **GnuTLS**. However, outside the predefined services supported by Enginsight, we cannot guarantee that TLS interception will work with every service that uses OpenSSL or GnuTLS.

**Enabling the TLS Interception Feature**

For your hosts to decrypt and analyze encrypted network traffic, one of the following requirements must be met:

* The **Enginsight IDS** and **TLS Interception** options must be enabled in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md).

OR

* The **TLS Interception** option must be enabled under **Hosts** → **Policy Manager** via a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md).

***

## Important Notes

* Be aware that the **RAM usage** of Pulsar can **increase significantly** under load when TLS interception is enabled.
* TLS interception can have a substantial impact on the target service. We therefore strongly recommend that you **always test TLS interception in a controlled environment** with the intended service before using it in production.

***

## TLS Interception: Menu Structure

Under **Hosts** → **TLS Interception**, you can find various options for analyzing encrypted services, processes, and connections on Linux hosts for attack patterns.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **TLS Interception** menu item to expand or collapse the corresponding submenu.

The following submenu items are available:

{% columns %}
{% column width="33.33333333333333%" %}

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2F93pKtcNM6NdJu2FXwZ4f%2FEnginsight-EN-Menu-Hosts-TLS%20Interception.jpg?alt=media&amp;token=f04df3e4-2a6b-4e15-bf7a-770cd545ec19" alt=""><figcaption></figcaption></figure>
{% endcolumn %}

{% column width="66.66666666666667%" %}

* [Rules](/docs/manual/english/platform-usage/hosts/tls-interception/rules.md)
* [Mappings](/docs/manual/english/platform-usage/hosts/tls-interception/mappings.md)
  {% endcolumn %}
  {% endcolumns %}

<i class="fa-grip-dots-vertical">:grip-dots-vertical:</i> Click and hold the **TLS Interception** menu item to move it, including all submenu items, within the menu tree using drag and drop.

***