I am trying to set up HTTP.SYS ETW traces from Event Tracing in HTTP.sys to capture the TLS/Cipher Suites data for my web server. When I look at the CSV or XML traces, I see a bunch of events related to the SSL handshake:
However, I don't find things like TLS Version, Cipher Suite, Exchange Strength, etc. Is it not available in ETW Traces? I could not find any useful documentation around this.