The Wayback Machine - https://web.archive.org/web/20201004171006/https://github.com/yeti-platform/yeti/issues/550
Skip to content

/ yeti

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add observable type JA3 #550

Open
dumprop opened this issue Jan 29, 2020 · 2 comments
Open

Add observable type JA3 #550

dumprop opened this issue Jan 29, 2020 · 2 comments
Assignees
@sebdraven
Labels
feature-request feed

Comments

@dumprop
Copy link
Contributor

@dumprop dumprop commented Jan 29, 2020

JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence

More info: https://github.com/salesforce/ja3

Can it be helpful for yeti?
@tomchop
Copy link
Collaborator

@tomchop tomchop commented Jan 29, 2020

Yes, definitely! It would be nice to add it as an observable type. Where would you say we would get the "source data" from?
@dumprop
Copy link
Contributor Author

@dumprop dumprop commented Jan 31, 2020

Abuse have a ja3 feed: https://sslbl.abuse.ch/blacklist/ja3_fingerprints.csv
@sebdraven sebdraven self-assigned this Mar 31, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature-request feed
3 participants
@tomchop @sebdraven @dumprop
You can’t perform that action at this time.