tls-1----Page:5
1  2  3  4  5  6  7  8  9 

Application Support
To gather evidence from an unchanged application, the evidence start alerts are sent immediately after the Finished message, and the evidence end alerts are sent at the end of the session
If willing to change an application, then alerts can be placed at “interesting” content
PPT Version