osquery should report that. are you using tls_dump flag?