The tlsplaintext Task

Type

Source

Output

TLSPayload

tlsplaintext is an ordered unique packet tlsplaintext capture task. The decrypted TLS plain-text payload is captured directly from the process.

Configuration options

tlsplaintext has the following configuration options:

payload

default true By default, the tlsplaintext Task publishes the raw payload as a base64 string. By setting this value to "false", the payload will not be published.

For example:

payload:false
fullContainer

default false Publish the full container metadata, including labels and annotations.

For example:

fullContainer:true

Conditions

tlsplaintext requires one of the following Conditions to be defined:

process.pid

Filtering tlsplaintext to collect by Process PID.

process.name

Filtering tlsplaintext to collect by Process Name.

container.id

Filtering tlsplaintext to collect by Container ID/UID.

container.name

Filtering tlsplaintext to collect by Container Name.

container.label

Filtering tlsplaintext to collect by Container Label value or key=value.

pod.id

Filtering tlsplaintext to collect by Pod ID/UID.

pod.name

Filtering tlsplaintext to collect by Pod Name.

pod.namespace

Filtering tlsplaintext to collect by Pod K8s Namespace.

pod.label

Filtering tlsplaintext to collect by Pod Label value or key=value.

tlsplaintext will not produce data without a Condition.

Output

tlsplaintext

map Hold the tlsplaintext output.

tlsplaintext.ts

uint64 Nanosecond-precision relative timestamp of when the event was produced. It is not an absolute timestamp (not Epoch), but it can still be used for precise timestamp comparison.

tlsplaintext.direction

string Direction of flow, either: RX or TX.

tlsplaintext.flowID

string A unique identifier for the flow by hashing the clientrandom value.

tlsplaintext.length

string The length of the flow.

tlsplaintext.payload

string (optional, see configuration options) The raw payload as a base64 string.

tlsplaintext.meta

map of string to dynamic Extra meta data produced by the tlsplaintext procedure.

tlsplaintext.process

map Holds the Process information.

tlsplaintext.process.pid

uint32 Process PID.

tlsplaintext.process.ppid

uint32 Process Parent PID.

tlsplaintext.process.name

string Process name.

tlsplaintext.process.cmd

string Command line string.

tlsplaintext.process.exe

string Executable name.

tlsplaintext.process.ns

string Namespace in the format of {device ID}-{inode number}.

tlsplaintext.process.startedAt

string Time the process started.

tlsplaintext.process.container

map Container information for process (if it is a container).

tlsplaintext.process.container.ID

string ID of Container.

tlsplaintext.process.container.Name

string Name of Container.