search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
103 stars 4.92k forks source link

Packetbeat TLS [Client|Server] tls.[client|server].supported_ciphers on one string #34842

Open FrancoisLAGANT opened 1 year ago

FrancoisLAGANT commented 1 year ago

Hello, Would it be possible to integrate an additional field concerning the tls client|server support_ciphers? This field currently is broken down for each cipher presented. The problem is that we lose the order of preference of the tls client. So it would be possible to have a text field listing all the ciphers in the order of preference of the client. Ciphers.list = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, etc" gold Ciphers.list = "0xC030, 0xC02C, etc" Thanks for your feedback. Cordially

elasticmachine commented 1 year ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

efd6 commented 1 year ago

I think this probably needs a proposal to the ECS repo first. The loss of cipher preference is unfortunate and something that we should probably try to solve. Making a proposal for this will help us come to the best solution.

elasticmachine commented 9 months ago

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)