If its layer 7, then you have to push a cert to the endpoints and MITM the traffic since everything is running SSL/TLS. Not sure that is exactly safer since now your security monitoring tools have access to everyone's password and authentication credentials.