Added by Mats Klepsland almost 10 years ago. Updated over 6 years ago.
Description
Suricata should support more TLS keywords than it currently does. See TLS keyword expansion for more information of what I'm suggesting and add your comments here :)
I began a prototype to add the cipher suite to the JSON output - are you already planning to do this?
Yeah, this is already planned. The plan is to add custom TLS logging (both for tls-log and json-tls), and then start logging more as more TLS stuff is decoded when more TLS keywords are added. Logging cipher_suite from server_hello is on my todo.
Hello Mats - has there been any progress on the expanded logging, or should I resume my prototyping?
Hi Mats, could you update the wiki doc to indicate what has been implemented?