Skip to content

Commit 467c9b4

Browse files
committed
new: [ja4-plus] new MISP object template to describe JA4+ fingerprints
fix: MISP/MISP#9759
1 parent 5a54cf6 commit 467c9b4

1 file changed

Lines changed: 45 additions & 0 deletions

File tree

objects/ja4-plus/definition.json

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"attributes": {
3+
"description": {
4+
"description": "Description of the JA4+ fingerprint including scope, collection or specific notes which could help an analyst to reproduce the calculation.",
5+
"misp-attribute": "text",
6+
"ui-priority": 1
7+
},
8+
"ip-src": {
9+
"description": "IP address related to this JA4+ fingerprint.",
10+
"misp-attribute": "ip-src",
11+
"ui-priority": 1,
12+
"multiple": true
13+
},
14+
"ja4-type": {
15+
"description": "One of the JA4+ type expressed as short name.",
16+
"misp-attribute": "text",
17+
"ui-priority": 1,
18+
"sane_default": [
19+
"JA4",
20+
"JA4S",
21+
"JA4H",
22+
"JA4L",
23+
"JA4X",
24+
"JA4SSH",
25+
"JA4T",
26+
"JA4TS",
27+
"JA4TScan"
28+
]
29+
},
30+
"ja4-fingerprint": {
31+
"description": "A JA4+ fingerprint as defined by the JA4+ standard in textual format.",
32+
"misp-attribute": "text",
33+
"ui-priority": 1
34+
}
35+
},
36+
"description": "JA4 is a technique for creating network fingerprints that are easy to produce and can be easily shared for threat intelligence. https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/README.md",
37+
"meta-category": "network",
38+
"name": "ja3",
39+
"required": [
40+
"ja4-fingerprint",
41+
"ja4-type"
42+
],
43+
"uuid": "2c15c75e-e7db-4b62-8d17-633e7571818f",
44+
"version": 1
45+
}

0 commit comments

Comments
 (0)