Generating event streams from encrypted network traffic monitored by remote capture agents

A non-transitory computer-readable storage medium storing instructions which, when executed by a processor, cause the processor to perform operations comprising:

• receiving, by a remote capture agent, configuration information for generating time-stamped events based on network traffic monitored by the remote capture agent;
• identifying a packet flow from the network traffic;
• determining that network packets of the packet flow are encrypted network packets;
• obtaining decrypted network packets by decrypting the encrypted network packets;
• generating, based on the configuration information, an event stream comprising time-series event data including data included in the decrypted network packets;
• and
• transmitting the event stream to another component on the network.

A system comprising:

• a first one or more electronic devices to implement a remote capture agent, wherein remote capture agent includes first instructions that upon execution cause the remote capture agent to:
• receive configuration information for generating time-stamped events based on network traffic monitored by the remote capture agent,
• identify a packet flow from the network traffic,
• determine that network packets of the packet flow are encrypted network packets,
• obtain decrypted network packets by decrypting the encrypted network packets,
• generate, based on the configuration information, an event stream comprising time-series event data including data included in the decrypted network packets, and
• transmit the event stream to another component on the network;
• and
• a second one or more electronic devices to implement a data storage server, wherein the data storage server includes second instructions that upon execution cause the data storage server to:
• receive the event stream from the remote capture agent, and
• store the event stream.