tls.yml

name: tls
title: TLS
description: >
  You can store TLS-related metadata under `tls.`, when appropriate.

fields:
- name: source
  fields:
  - name: ip
    example: 10.1.1.10

- name: destination
  fields:
  - name: ip
    example: 5.5.5.5

  - name: port
    example: 443

- name: tls
  fields:
    - name: version
      type: keyword
      description: >
        TLS version.
      example: TLSv1.2

    - name: certificates
      type: keyword
      description: >
        An array of certificates.
      ignore_above: -1
      doc_values: false

    - name: servername
      type: keyword
      description: >
        Server name requested by the client.
      example: localhost

    - name: ciphersuite
      type: keyword
      description: >
        Name of the cipher used for the communication.
      example: ECDHE-ECDSA-AES-128-CBC-SHA