Domain Fronting Reporting

The Cloud proxy now records discrete TLS Server Name Indication (SNI) and decrypted HTTP Host in web transaction logs, enabling security teams to identify and investigate domain fronting and transport-layer evasion techniques. Both fields, "HTTP Host" and "TLS SNI" are available in Report Builder, Transaction Viewer and SIEM Export.