Skip to content
NewVerdictIQ Connector is here. One Docker image enriches your DNS logs with verdicts inside your network and forwards them to your SIEM.Install guide

SSL Behavior

SSL certificate lifecycle: issuance, length, issuer reputation, certificate-rotation patterns. Each fires with named evidence and a 3-question analyst Q&A trail.

About

What SSL Behavior captures

SSL certificate lifecycle: issuance, length, issuer reputation, certificate-rotation patterns. Tier-1 SOC analysts use them to cut triage time on suspicious http crawling history behavior; CTI teams pivot from them to the broader campaign graph.

Verdict scenarios

How SSL Behavior shapes the call

Three real-world situations where SSL Behavior evidence dominates the decision. Verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A site serving a self-signed or short-validity certificate issued in the last 24 hours.

VerdictIQ explains

“Decline. Throwaway certificates are the standard launch shape for phishing. Real businesses provision proper TLS before going live.”

Medium riskVERDICT · REVIEW
The situation

A site rotating its certificate every few weeks across multiple low-trust issuers.

VerdictIQ explains

“Send to analyst review. The rotation pattern is unusual and may indicate evasion behavior. Confirm before granting trust.”

Low riskVERDICT · ALLOW
The situation

A site on a long-validity OV or EV certificate from a top-tier issuer, held for years.

VerdictIQ explains

“Allow. The certificate posture matches a mature, organization-validated property. No SSL reason to delay.”

Sibling subgroups

Other subgroups in HTTP Crawling History

6 more subgroups in this group, each bundling signals that share a different mechanism. Tap one to inspect its signal names.

See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail

See SSL Behavior signals fire on your data

Free tier: 1,000 verdicts/month, LLM layer included.