No TLS details

Elastic Security SIEM
1

See also attached image:

SIEM - Empty TLS table
SIEM - Empty TLS table1122×603 50.4 KB

While there seem to be thousands of TLS handshakes, the SIEM-network table with TLS details is empty.

The Packetbeat config details:

- type: tls
  # Configure the ports where to listen for TLS traffic. You can disable
  # the TLS protocol by commenting out the list of ports.
  ports: [ 443, 993, 587, 465, 995 ]

  # Certificate details
  # WLM | 2020mar8
  send_certificates: true
  include_raw_certificates: true
  include_detailed_fields: true
  fingerprints: [ md5, sha1, sha256 ]

What am I overlooking here?

Thanks - Will

2

Unfortunately, nothing. We've been working to standardize on Elastic Common Schema and transition the data sources and UI to be fully based on it. The queries in the UI predate TLS being part of the schema. And now it needs an update. I've opened an issue to get this done [SIEM] Update TLS tables for ECS 1.4+ · Issue #60026 · elastic/kibana · GitHub.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

5

Perhaps somewhat late - but still - thank you!