Packetbeat - full URL on HTTPS traffic?

Elastic Stack Beats
1

Is it possible to get the full URL from HTTPS traffic. I would like to be able to view the full URI that a client is attempting to access.

e.g. https://myserver.com/some_part/this_file.exe

I have packetbeat monitoring port 443, and can see the request being logged by packetbeat. I can see the full urls + uri paths for cleartext protocols like HTTP. So wondering if it's possible for HTTPS. Perhaps this is too low down on the network stack?

2

No because the path and query parameters are encrypted unless u can do MITM.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.