A method for monitoring communication over a network with a network monitoring device (NMD) that performs actions, comprising: passively monitoring a plurality of network packets that are communicated between one or more client computers and one or more server computers; obtaining correlation information for one or more network packets used to establish a secure communication session; and when the secure communication session is established between a client computer and a server computer, perform further actions, including: obtaining a session key and other correlation information that corresponds to the secure communication session, wherein the session key and the other correlation information are provided by a key provider; determining a network connection flow that corresponds to the secure communication session based on a match of the correlation information that corresponds to the secure communication session with the other correlation information provided by the key provider; decrypting one or more network packets of the network connection flow that are communicated between the client computer and the server computer over the secure communication session; and providing analysis of the secure communication session based on the contents of the one or more decrypted network packets. passively monitoring a plurality of network packets that are communicated between one or more client computers and one or more server computers; obtaining correlation information for one or more network packets used to establish a secure communication session; and when the secure communication session is established between a client computer and a server computer, perform further actions, including: obtaining a session key and other correlation information that corresponds to the secure communication session, wherein the session key and the other correlation information are provided by a key provider; determining a network connection flow that corresponds to the secure communication session based on a match of the correlation information that corresponds to the secure communication session with the other correlation information provided by the key provider; decrypting one or more network packets of the network connection flow that are communicated between the client computer and the server computer over the secure communication session; and providing analysis of the secure communication session based on the contents of the one or more decrypted network packets. obtaining a session key and other correlation information that corresponds to the secure communication session, wherein the session key and the other correlation information are provided by a key provider; determining a network connection flow that corresponds to the secure communication session based on a match of the correlation information that corresponds to the secure communication session with the other correlation information provided by the key provider; decrypting one or more network packets of the network connection flow that are communicated between the client computer and the server computer over the secure communication session; and providing analysis of the secure communication session based on the contents of the one or more decrypted network packets. <EOS>