ECS::LogEntry::Tls::Client
Inherits JSON::Serializable < Struct < Value < Object
Constructors
Instance methods
tls.client.certificate
PEM-encoded stand-alone certificate offered by the client. This is usually
mutually-exclusive of client.certificate_chain since this value also exists in
that list.
Level: Extended Type: Keyword Example:
MII...
tls.client.certificate
PEM-encoded stand-alone certificate offered by the client. This is usually
mutually-exclusive of client.certificate_chain since this value also exists in
that list.
Level: Extended Type: Keyword Example:
MII...
tls.client.certificate_chain
Array of PEM-encoded certificates that make up the certificate chain offered by
the client. This is usually mutually-exclusive of client.certificate since that
value should be the first certificate in the chain.
Level: Extended Type: Keyword Example:
["MII...", "MII..."]
tls.client.certificate_chain
Array of PEM-encoded certificates that make up the certificate chain offered by
the client. This is usually mutually-exclusive of client.certificate since that
value should be the first certificate in the chain.
Level: Extended Type: Keyword Example:
["MII...", "MII..."]
Generates an UInt64 hash value for this object.
This method must have the property that a == b implies a.hash == b.hash.
The hash value is used along with == by the Hash class to determine if two objects
reference the same hash key.
Subclasses must not override this method. Instead, they must define hash(hasher),
though usually the macro def_hash can be used to generate this method.
tls.client.issuer
Distinguished name of subject of the issuer of the x.509 certificate presented by the client.
Level: Extended Type: Keyword Example:
CN=MyDomain Root CA, OU=Infrastructure Team, DC=mydomain, DC=com
tls.client.issuer
Distinguished name of subject of the issuer of the x.509 certificate presented by the client.
Level: Extended Type: Keyword Example:
CN=MyDomain Root CA, OU=Infrastructure Team, DC=mydomain, DC=com
tls.client.ja3
A hash that identifies clients based on how they perform an SSL/TLS handshake.
Level: Extended Type: Keyword Example:
d4e5b18d6b55c71272893221c96ba240
tls.client.ja3
A hash that identifies clients based on how they perform an SSL/TLS handshake.
Level: Extended Type: Keyword Example:
d4e5b18d6b55c71272893221c96ba240
tls.client.not_after
Date/Time indicating when client certificate is no longer considered valid.
Level: Extended Type: Date Example:
2021-01-01T00:00:00.000Z
tls.client.not_after
Date/Time indicating when client certificate is no longer considered valid.
Level: Extended Type: Date Example:
2021-01-01T00:00:00.000Z
tls.client.not_before
Date/Time indicating when client certificate is first considered valid.
Level: Extended Type: Date Example:
1970-01-01T00:00:00.000Z
tls.client.not_before
Date/Time indicating when client certificate is first considered valid.
Level: Extended Type: Date Example:
1970-01-01T00:00:00.000Z
tls.client.server_name
Also called an SNI, this tells the server which hostname to which the client is
attempting to connect. When this value is available, it should get copied to
destination.domain.
Level: Extended Type: Keyword Example:
www.elastic.co
tls.client.server_name
Also called an SNI, this tells the server which hostname to which the client is
attempting to connect. When this value is available, it should get copied to
destination.domain.
Level: Extended Type: Keyword Example:
www.elastic.co
tls.client.subject
Distinguished name of subject of the x.509 certificate presented by the client.
Level: Extended Type: Keyword Example:
CN=myclient, OU=Documentation Team, DC=mydomain, DC=com
tls.client.subject
Distinguished name of subject of the x.509 certificate presented by the client.
Level: Extended Type: Keyword Example:
CN=myclient, OU=Documentation Team, DC=mydomain, DC=com
tls.client.supported_ciphers
Array of ciphers offered by the client during the client hello.
Level: Extended Type: Keyword Example:
["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]
tls.client.supported_ciphers
Array of ciphers offered by the client during the client hello.
Level: Extended Type: Keyword Example:
["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]