Skip to content

Commit 8753de0

Browse files
committed
new: [jarm] new jarm object to describe TLS/SSL implementation matching
a jarm fingerprint
1 parent d5b8373 commit 8753de0

1 file changed

Lines changed: 48 additions & 0 deletions

File tree

objects/jarm/definition.json

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"attributes": {
3+
"jarm": {
4+
"description": "JARM Hash of this implementation",
5+
"misp-attribute": "jarm",
6+
"ui-priority": 1
7+
},
8+
"reference": {
9+
"description": "Reference to the tool matching this fingerprint",
10+
"disable_correlation": true,
11+
"misp-attribute": "link",
12+
"ui-priority": 0
13+
},
14+
"scope": {
15+
"description": "Scope of the tool",
16+
"disable_correlation": true,
17+
"misp-attribute": "text",
18+
"ui-priority": 0,
19+
"values_list": [
20+
"Malicious - C2",
21+
"Malicious - Client",
22+
"Malicious - Unknown",
23+
"Legitimate",
24+
"Undefined"
25+
]
26+
},
27+
"tls-implementation": {
28+
"description": "SSL/TLS implementation matching this object",
29+
"disable_correlation": true,
30+
"misp-attribute": "text",
31+
"ui-priority": 0
32+
},
33+
"tool": {
34+
"description": "Tool having this jarm fingerprint",
35+
"disable_correlation": true,
36+
"misp-attribute": "text",
37+
"ui-priority": 1
38+
}
39+
},
40+
"description": "Jarm object to describe an TLS/SSL implementation used for malicious or legitimate use-case.",
41+
"meta-category": "network",
42+
"name": "jarm",
43+
"requiredOneOf": [
44+
"jarm"
45+
],
46+
"uuid": "8220ce60-ce3f-4be4-afa9-743f94ec37e0",
47+
"version": 1
48+
}

0 commit comments

Comments
 (0)