Integration NPC

Elastic Stack Elastic Agent
1

We would like to submit a feature request to extend the official Network Packet Capture integration with native support for three additional application-layer protocols:

  • SMB (Server Message Block) – TCP/445

  • IMAP (Internet Message Access Protocol) – TCP/143, TCP/993

  • SMTP (Simple Mail Transfer Protocol) – TCP/25, TCP/465, TCP/587

Background and Business Justification

We use Elastic Security as a central platform for Security Operations Center (SOC) monitoring, threat detection, incident investigation, and network security analytics.

The existing Network Packet Capture integration provides valuable network visibility. However, the lack of native SMB, IMAP, and SMTP protocol analyzers limits our ability to monitor important network activities at the application layer.

These protocols are particularly relevant to enterprise security monitoring and threat detection:

1. SMB – Lateral Movement and File Access Monitoring

Native SMB protocol analysis would improve visibility into:

  • Network file-sharing activities and access attempts.

  • SMB authentication and authorization outcomes, where visible.

  • File operations, including opening, reading, writing, deleting, and renaming files.

  • Access to administrative shares.

  • Potential lateral movement and suspicious file access patterns.

  • Unusual SMB activity associated with ransomware or unauthorized data access.

2. IMAP – Mailbox Access and Authentication Monitoring

Native IMAP protocol analysis would provide visibility into:

  • Mailbox access and authentication attempts.

  • Successful and failed authentication events, where observable.

  • IMAP commands and server responses.

  • Suspicious mailbox access patterns.

  • Potential unauthorized access to enterprise email infrastructure.

3. SMTP – Email Communication and Security Monitoring

Native SMTP protocol analysis would enable monitoring of:

  • SMTP sessions and protocol commands.

  • Sender and recipient metadata.

  • Authentication attempts and outcomes, where observable.

  • SMTP response codes and rejected transactions.

  • Suspicious outbound email activity.

  • Potential compromised accounts, unauthorized mail relaying, and unusual email communication patterns.

Requested Functionality

We would like Elastic to consider implementing these protocols as native analyzers within the official Network Packet Capture integration, with the following capabilities:

  1. Full configuration and lifecycle management through Elastic Fleet and Elastic Agent.

  2. Application-layer protocol parsing and extraction of relevant security metadata.

  3. Compatibility with Elastic Common Schema (ECS).

  4. Correlation with Elastic Security detection rules, alerts, and investigation workflows.

  5. Support for TCP session tracking and protocol transaction reconstruction.

  6. Configurable packet capture interfaces and protocol ports.

  7. Metadata-only collection options to minimize exposure of sensitive data.

  8. Protocol-specific dashboards and visualization capabilities.

  9. Compatibility with existing packet capture mechanisms, including AF_PACKET on Linux.

We understand that encrypted sessions, such as IMAPS, SMTPS, STARTTLS-protected sessions, and encrypted SMB traffic, cannot be fully analyzed without access to decrypted traffic. Therefore, protocol metadata extraction should be supported wherever technically possible, with clear documentation of encryption-related limitations.

Expected Outcome

Our primary objective is to use the official Elastic Agent and Fleet-managed integrations to provide comprehensive network protocol monitoring without deploying separate third-party network analysis solutions or maintaining custom protocol analyzers.

Native SMB, IMAP, and SMTP support would significantly improve Elastic Security's network detection and response capabilities, particularly in environments where centralized SOC monitoring, operational consistency, and vendor-supported integrations are essential.

We believe this enhancement would be valuable not only for our environment but also for other enterprise customers using Elastic Security for network threat detection and investigation.

Questions

Could you please clarify:

  1. Are there any existing plans or roadmap items to introduce native SMB, IMAP, or SMTP support into Network Packet Capture?

  2. Would Elastic consider implementing these protocols as part of the official integration?

  3. Is there an existing feature request or GitHub issue that we could follow or contribute to?

  4. Could this request be forwarded to the engineering or product management team responsible for Network Packet Capture and Packetbeat?

Thank you for considering this enhancement request.

Best regards,