# TLS Information

**URL:** <https://discuss.elastic.co/t/tls-information/253794>\
**Category:** SIEM\
**Tags:** elastic-stack-security\
**Created:** [October 30, 2020, 9:54am UTC](https://discuss.elastic.co/t/tls-information/253794 "2020-10-30T09:54:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mauricio\_Borges](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mauricio_borges/32/54964_2.png) [@Mauricio\_Borges](https://discuss.elastic.co/u/Mauricio_Borges)\
**Post date:** [October 30, 2020, 9:54am UTC](https://discuss.elastic.co/t/tls-information/253794/1 "2020-10-30T09:54:21Z")

</div>

Hi Team!  
What are the integration tools ( beats family etc ) required to we collect certificates data from session connections to identify TLS Version, Ciphers, Valid until, Issuer, Subject, fingerprint etc from a host server ?  
Idea would be to **inspect or monitor TLS Network Traffic** as well see the TLS Versions, Certificates Validations to proactive take action as need.  
Appreciate any help!  
Mauricio

 ![Elastic-Security-TLS](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d18431039aba134328fa8b8420f2b4207a3a00c9.jpeg)

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 30, 2020, 10:01am UTC](https://discuss.elastic.co/t/tls-information/253794/2 "2020-10-30T10:01:53Z")

</div>

Hello Mauricio,

Maybe there are more applications that can do this out of the box but I am using the following two:

- HeartBeat collects TLS data when monitoring an HTTPS endpoint
- PacketBeat collects this data when TLS protocol is configured

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![Mauricio\_Borges](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mauricio_borges/32/54964_2.png) [@Mauricio\_Borges](https://discuss.elastic.co/u/Mauricio_Borges)\
**Post date:** [October 30, 2020, 10:26am UTC](https://discuss.elastic.co/t/tls-information/253794/3 "2020-10-30T10:26:35Z")

</div>

Thanks Wolfram!  
If that solution be able to inspect all TLS information and transactions from every Port we have this protocol enabled, will be very helpful!!!

For example, today we have couple middlewares on servers using TLS, so if the Beats can identify the Port used, TLS version and Certification expiration would be very very good to we proactive take actions at security side and also to identify when a certificate will expire.

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 30, 2020, 11:10am UTC](https://discuss.elastic.co/t/tls-information/253794/4 "2020-10-30T11:10:11Z")

</div>

Hello Mauricio,

Unfortunately, I don't think that PacketBeat can detect that automatically. As far as I know you have to configure a [list of ports](https://www.elastic.co/guide/en/beats/packetbeat/7.9/common-protocol-options.html#_ports).

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2020, 11:10am UTC](https://discuss.elastic.co/t/tls-information/253794/5 "2020-11-27T11:10:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.