Corelight Encrypted Traffic Collection is a network security analytics product that provides visibility into encrypted network traffic without requiring decryption. The product analyzes SSL, SSH, RDP, DNS, and VPN connections by examining observable elements such as timestamps, packet sizes, flow direction, and other traffic characteristics. The product employs Zeek network security monitoring to perform analysis and generates insights through various detection methods. For VPN traffic, it identifies endpoints using VPN connections and their destination countries. For DNS, it detects DNS over HTTPS (DoH) queries to known providers. The product also identifies custom encryption without observed handshakes and unencrypted connections on ports where encryption is expected. For RDP connections, the product infers authentication methods, detects brute force attempts, identifies client types, and monitors excessive channel joins. SSH capabilities include detecting stepping stones through statistical analysis, agent forwarding for lateral movement detection, authentication bypass attempts, brute force attacks, file transfers, interactive sessions, and SSH tunneling activities. It also monitors for MFA usage and generates HASSH fingerprints. SSL/TLS monitoring includes certificate tracking for expired, self-signed, invalid, and weak certificates, as well as JA3/S fingerprinting for client and server negotiations. The product integrates detection results into Corelight's evidence and analytics suite and is included as part of Corelight subscriptions as an activatable detection set.