# Endpoint Security Network Events Missing & Not Parsing Data

**URL:** <https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982>\
**Category:** Endpoint Security\
**Created:** [January 1, 2021, 6:43am UTC](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982 "2021-01-01T06:43:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Man715](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/man715/32/73182_2.png) [@Man715](https://discuss.elastic.co/u/Man715)\
**Post date:** [January 1, 2021, 6:44am UTC](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982/1 "2021-01-01T06:44:00Z")

</div>

I am running into two issues with the Network Events.

The first issue is that HTTPS traffic is not getting identified as HTTPS traffic and is has an empty http.request.body.content and most HTTP traffic is the same.

 ![no_http.request](https://us1.discourse-cdn.com/elastic/original/3X/2/9/2948ec247fd496f5e6cf58b103496fe7ec5ed254.gif)

The other issue is that the http.request.body.content does not get parsed (when it does exist) like Packetbeat does therefore some dashboards do not work. For example, when drilling down into an IP from the network map in the SIEM, you will not see HTTP Requests associated with that IP since several fields do not exist such as http.request.method.

![image](https://us1.discourse-cdn.com/elastic/original/3X/4/6/462092ad3505b2ea7efad10361f6de0156f67257.png)

Is there a way to get this data parsed like Packetbeat or is Packetbeat the only way to get this functionality?

Thank you.

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [January 7, 2021, 9:26pm UTC](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982/2 "2021-01-07T21:26:25Z")

</div>

Hi @man715, thanks for checking out Endpoint Security.

Endpoint does have some overlap with various Beats (Packetbeat in this case) for what data type is collected from machines. However, the Endpoint and Beats do not share a code base and so they don't necessarily fill in the same data in every event, which is what you're seeing.

Overtime we'll work to close gaps like this. Its good to hear the type of data you feel is missing from Endpoint data. For the time being please consider Endpoint and Beats as complimentary products, neither is a replacement for the other.

---

<div class="post-metadata">

**Author:** ![Man715](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/man715/32/73182_2.png) [@Man715](https://discuss.elastic.co/u/Man715)\
**Post date:** [January 8, 2021, 4:07am UTC](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982/3 "2021-01-08T04:07:00Z")

</div>

Thank you for your response. I have started using PacketBeats again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2021, 4:07am UTC](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982/4 "2021-02-05T04:07:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.