Is there a way to include the Resources, such as URLs in all connections events, not just in the Sessions?
I have observed,when using a non-transparent proxy, that the destination resources, while being present in "Session" events, are absent in subsequent connections, for as long as session is maintained.
It is possible that this behavior is not unique to Proxy traffic, but I did not yet get a chance to verify that.
The absence of the resources in connections makes it very difficult to pinpoint host-to-destination calls made over existing sessions based on time.
In case of proxy traffic, all you see is the http/s call from client to proxy with no idea of the destination.