The TLS tables in the SIEM UI we first created before there were any TLS fields defined in Elastic Common Schema (ECS). Since ECS 1.4 the TLS fields have been added. The Beat data sources are being updated to produce ECS conforming TLS events. Now the queries executed by the UI need to be updated.

One open question is whether the tables should remain backward-compatible with the earlier Packetbeat format for some time period.

See also:

• [SIEM] Non-ECS fields in SIEM #43649
• [Packetbeat] Output ECS-compatible TLS fields beats#15497 (in v7.6.0)
• [Filebeat] Add ECS TLS fields to existing filesets beats#15757 (in v7.7.0)