zeek_query_ssl
Search SSL/TLS connection logs by filtering on SNI hostname, TLS version, certificate validation status, subject, or issuer to identify connections matching security criteria.
Instructions
Search Zeek SSL/TLS connection logs. Filter by SNI hostname, TLS version, certificate validation status, subject, and issuer.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "zeek_query_ssl"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| dstIp | No | Destination IP address | |
| limit | No | Max results | |
| srcIp | No | Source IP address | |
| issuer | No | Certificate issuer (partial match) | |
| timeTo | No | End time (ISO 8601) | |
| subject | No | Certificate subject (partial match) | |
| version | No | TLS version (TLSv10, TLSv11, TLSv12, TLSv13, SSLv3) | |
| timeFrom | No | Start time (ISO 8601) | |
| serverName | No | SNI hostname (supports wildcards) | |
| validationStatus | No | Certificate validation status (ok, self signed certificate, etc.) |