TLS Session Fields

Is there already a consensus as to where to place session properties for TLS sessions? I found some reference to a tls subtree in #64, but nothing in the schema itself.

Will there be some session.tls group or the like with TLS session related fields, eg. protocol versions, ciphers, session identifier, and the like?

[peterpramb]

Thanks for the hint.

The field list in Packetbeat is fairly exhaustive. The only missing field for our use case is the verification result of the provided client certificate (which is really an application property and nothing available on network level), so for the sake of completeness something like:

- name: tls.client_certificate_verification_result
  type: keyword
  description: >
    The result of the server side verification of the provided client certificate.
    This is specific to the application terminating the TLS session. The value
    depends on the TLS library in use. With OpenSSL the resulting string is
    usually one of 'NONE', 'SUCCESS', 'GENEROUS', or 'FAILED:reason'.

And for the certificate attributes I specifically miss (L)ocality and Street, which can be ocasionally seen in the wild.

[peterpramb]

Ok, fine for me.