TLS module for packetbeat

packetbeat/_meta/beat.reference.yml

@@ -421,6 +421,18 @@ packetbeat.protocols:
   # incoming responses, but sent to Elasticsearch immediately.
   #transaction_timeout: 10s
 
+- type: tls
+  # Enable TLS monitoring. Default: true
+  #enabled: true
+
+  # Configure the ports where to listen for TLS traffic. You can disable
+  # the TLS protocol by commenting out the list of ports.
+  ports: [443]
+
+  # If this option is enabled, the client and server certificates and
+  # certificate chains are sent to Elasticsearch. The default is true.
+  #send_certificates: true
+
 #=========================== Monitored processes ==============================
 
 # Configure the processes to be monitored and how to find them. If a process is

packetbeat/_meta/beat.yml

@@ -93,6 +93,11 @@ packetbeat.protocols:
   # the NFS protocol by commenting out the list of ports.
   ports: [2049]
 
+- type: tls
+  # Configure the ports where to listen for TLS traffic. You can disable
+  # the TLS protocol by commenting out the list of ports.
+  ports: [443]
+
 #==================== Elasticsearch template setting ==========================
 
 setup.template.settings:

packetbeat/_meta/fields.yml

@@ -1748,3 +1748,294 @@
             If the call resulted in exceptions, this field contains the exceptions in a human
             readable format.
 
+- key: tls
+  title: "TLS"
+  description: >
+    TLS-specific event fields.
+  fields:
+    - name: tls
+      type: group
+      fields:
+        - name: handshake_completed
+          type: boolean
+          description: >
+            Whether the TLS negotiation has been successful and the session has
+            transitioned to encrypted mode.
+
+        - name: resumed
+          type: boolean
+          description: >
+            If the TLS session has been resumed from a previous session.
+
+        - name: resumption_method
+          type: keyword
+          description: >
+            If the session has been resumed, the underlying method used. One of
+            "id" for TLS session ID or "ticket" for TLS ticket extension.
+
+        - name: client_certificate_requested
+          type: boolean
+          description: >
+            Whether the server has requested the client to authenticate itself
+            using a client certificate.
+
+        - name: client_hello
+          type: group
+          fields:
+            - name: version
+              type: keyword
+              description: >
+                The version of the TLS protocol by which the client wishes to
+                communicate during this session.
+
+            - name: timestamp
+              type: date
+              description: >
+                The current time and date according to the client's internal clock.
+
+            - name: supported_ciphers
+              type: array
+              description: >
+                List of ciphers the client is willing to use for this session.
+                See https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4
+
+            - name: supported_compression_methods
+              type: array
+              description: >
+                The list of compression methods the client supports.
+                See https://www.iana.org/assignments/comp-meth-ids/comp-meth-ids.xhtml
+
+            - name: extensions
+              type: group
+              description: The hello extensions provided by the client.
+              fields:
+                - name: server_name_indication
+                  type: array
+                  description: List of hostnames
+
+                - name: application_layer_protocol_negotiation
+                  type: array
+                  description: >
+                    List of application-layer protocols the client is willing to use.
+
+                - name: session_ticket
+                  type: keyword
+                  description: >
+                    Length of the session ticket, if provided, or an empty string
+                    to advertise support for tickets.
+
+        - name: server_hello
+          type: group
+          fields:
+            - name: version
+              type: keyword
+              description: >
+                The version of the TLS protocol that is used for this session.
+                It is the highest version supported by the server not exceeding
+                the version requested in the client hello.
+
+            - name: timestamp
+              type: date
+              description: >
+                The current time and date according to the server's internal clock.
+
+            - name: selected_cipher
+              type: keyword
+              description: >
+                The cipher suite selected by the server from the list provided
+                by in the client hello.
+
+            - name: selected_compression_method
+              type: keyword
+              description: >
+                The compression method selected by the server from the list
+                provided in the client hello.
+
+            - name: extensions
+              type: group
+              description: The hello extensions provided by the server.
+              fields:
+                - name: application_layer_protocol_negotiation
+                  type: array
+                  description: Negotiated application layer protocol
+
+                - name: session_ticket
+                  type: keyword
+                  description: >
+                    Used to announce that a session ticket will be provided
+                    by the server. Always an empty string.
+
+
+        - name: client_certificate
+          type: group
+          description: Certificate provided by the client for authentication.
+          fields:
+
+            - name: version
+              type: long
+              description: X509 format version.
+
+            - name: serial_number
+              type: keyword
+              description: The certificate's serial number.
+
+            - name: not_before
+              type: date
+              description: Date before which the certificate is not valid.
+
+            - name: not_after
+              type: date
+              description: Date after which the certificate expires.
+
+            - name: public_key_algorithm
+              type: keyword
+              description: >
+                The algorithm used for this certificate's public key.
+                One of RSA, DSA or ECDSA.
+
+            - name: signature_algorithm
+              type: keyword
+              description: >
+                The algorithm used for the certificate's signature.
+
+            - name: subject
+              type: group
+              description: Subject represented by this certificate.
+              fields:
+                - name: country
+                  type: keyword
+                  description: Country code.
+
+                - name: organization
+                  type: keyword
+                  description: Organization name.
+
+                - name: organizational_unit
+                  type: keyword
+                  description: Unit within organization.
+
+                - name: province
+                  type: keyword
+                  description: Province or region within country.
+
+                - name: common_name
+                  type: keyword
+                  description: Name or host name identified by the certificate.
+
+            - name: alternative_names
+              type: array
+              description: Subject Alternative Names for this certificate.
+
+            - name: issuer
+              type: group
+              description: Entity that issued and signed this certificate.
+              fields:
+                - name: country
+                  type: keyword
+                  description: Country code.
+
+                - name: organization
+                  type: keyword
+                  description: Organization name.
+
+                - name: organizational_unit
+                  type: keyword
+                  description: Unit within organization.
+
+                - name: province
+                  type: keyword
+                  description: Province or region within country.
+
+                - name: common_name
+                  type: keyword
+                  description: Name or host name identified by the certificate.
+
+
+        - name: server_certificate
+          type: group
+          description: Certificate provided by the server for authentication.
+          fields:
+
+            - name: version
+              type: long
+              description: X509 format version.
+
+            - name: serial_number
+              type: keyword
+              description: The certificate's serial number.
+
+            - name: not_before
+              type: date
+              description: Date before which the certificate is not valid.
+
+            - name: not_after
+              type: date
+              description: Date after which the certificate expires.
+
+            - name: public_key_algorithm
+              type: keyword
+              description: >
+                The algorithm used for this certificate's public key.
+                One of RSA, DSA or ECDSA.
+
+            - name: signature_algorithm
+              type: keyword
+              description: >
+                The algorithm used for the certificate's signature.
+
+            - name: subject
+              type: group
+              description: Subject represented by this certificate.
+              fields:
+                - name: country
+                  type: keyword
+                  description: Country code.
+
+                - name: organization
+                  type: keyword
+                  description: Organization name.
+
+                - name: organizational_unit
+                  type: keyword
+                  description: Unit within organization.
+
+                - name: province
+                  type: keyword
+                  description: Province or region within country.
+
+                - name: common_name
+                  type: keyword
+                  description: Name or host name identified by the certificate.
+
+            - name: alternative_names
+              type: array
+              description: Subject Alternative Names for this certificate.
+
+            - name: issuer
+              type: group
+              description: Entity that issued and signed this certificate.
+              fields:
+                - name: country
+                  type: keyword
+                  description: Country code.
+
+                - name: organization
+                  type: keyword
+                  description: Organization name.
+
+                - name: organizational_unit
+                  type: keyword
+                  description: Unit within organization.
+
+                - name: province
+                  type: keyword
+                  description: Province or region within country.
+
+                - name: common_name
+                  type: keyword
+                  description: Name or host name identified by the certificate.
+
+
+        - name: server_certificate_chain
+          type: array
+          description: Chain of trust for the server certificate.