# Suricata Rule to monitor all the HTTPS Request with dest port 443

**URL:** <https://forum.suricata.io/t/suricata-rule-to-monitor-all-the-https-request-with-dest-port-443/4764>\
**Category:** Rules\
**Created:** [July 16, 2024, 10:05am UTC](https://forum.suricata.io/t/suricata-rule-to-monitor-all-the-https-request-with-dest-port-443/4764 "2024-07-16T10:05:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wa12](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@wa12](https://forum.suricata.io/u/wa12)\
**Post date:** [July 16, 2024, 10:05am UTC](https://forum.suricata.io/t/suricata-rule-to-monitor-all-the-https-request-with-dest-port-443/4764/1 "2024-07-16T10:05:19Z")

</div>

Hi.

I am trying to create a rule to monitor all the HTTPS request with the destination port 443 which includes all the HTTP methods & all the possible information that could be obtained from the request.  
None of the rules i have created have been able to generate detections.  
Requesting your assistance to get the rule sorted.  
Thanks

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [July 16, 2024, 10:21am UTC](https://forum.suricata.io/t/suricata-rule-to-monitor-all-the-https-request-with-dest-port-443/4764/2 "2024-07-16T10:21:44Z")

</div>

Please tell us more details, at least start with the rules and how you did configure your setup.  
Keep in mind, that HTTPS is encrypted, so you won’t see too much unless you decrypt it prior to the forwarding.

---

<div class="post-metadata">

**Author:** ![wa12](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@wa12](https://forum.suricata.io/u/wa12)\
**Post date:** [July 16, 2024, 11:16am UTC](https://forum.suricata.io/t/suricata-rule-to-monitor-all-the-https-request-with-dest-port-443/4764/3 "2024-07-16T11:16:58Z")

</div>

I am trying to monitor HTTPS requests from two specific ip address to a specific subnet

alert tcp 10.x.x.x any → 10.x.x.x/24 443 (msg:“http request dst 443”; flow:established,toserver; content:“18 21 22 0a 48 54 54 50 2f 31 2e 31|”; http.host; http.request\_body; tcp.dport eq 443;)

Suricata is installed on a physical server & the traffic is received from span(core switch)

---

<div class="post-metadata">

**Author:** ![satta](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/satta/32/18_2.png) [@satta](https://forum.suricata.io/u/satta)\
**Post date:** [July 17, 2024, 10:55am UTC](https://forum.suricata.io/t/suricata-rule-to-monitor-all-the-https-request-with-dest-port-443/4764/4 "2024-07-17T10:55:46Z")

</div>

If you just consume directly from the switch, you are not decrypting. In this case you can’t really look _into_ the contents (and look for things like your `content` pattern here (in which the leading `|` is missing BTW) – all you get is a `tls` event that gives you TLS parameters, certificate metadata, and maybe a SNI ([8.16. SSL/TLS Keywords — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/rules/tls-keywords.html)). You won’t be able to use the `http.*` keywords because of the encryption as you can’t even tell whether it’s HTTPS or some other TLS secured protocol.