JA3 Plugin

The JA3 filtering plugin searches each result set for a ja3_md5. If this is found the ja3 user agent will be inserted into the result set.

More information on JA3 fingerprinting can be found here

Generated fields

ja3_user_agent

Configuration example:

   # The ja3 plugin will insert the user agent for the ja3 signature found within a result set.
  # more information can be found at
  # https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967 
  ja3:
    enabled: 0
    # Location of the signature file to use. Can be obtained from
    # https://ja3er.com/getAllUasJson.
    # Users can create their own signature file with the following structure:
    # [{"User-Agent":"user agent name", "md5":"MD5HASH"},
    #  {"User-Agent":"user agent name", "md5":"MD5HASH"}]
    signatures: /etc/bigdata/ja3signatures.json

Configuration options

enabled

Used to enabled or disable the JA3 plugin (0 disabled, 1 enabled)

signatures

Path to the ja3 signature file