mirror of https://github.com/MISP/misp-objects
44 lines
1.4 KiB
JSON
44 lines
1.4 KiB
JSON
{
|
|
"attributes": {
|
|
"description": {
|
|
"description": "Type of detected software ie software, malware",
|
|
"misp-attribute": "text",
|
|
"ui-priority": 1
|
|
},
|
|
"first-seen": {
|
|
"description": "First seen of the SSL/TLS handshake",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "datetime",
|
|
"ui-priority": 0
|
|
},
|
|
"ip-dst": {
|
|
"description": "Destination IP address",
|
|
"misp-attribute": "ip-dst",
|
|
"ui-priority": 1
|
|
},
|
|
"ip-src": {
|
|
"description": "Source IP Address",
|
|
"misp-attribute": "ip-src",
|
|
"ui-priority": 1
|
|
},
|
|
"ja3-fingerprint-md5": {
|
|
"description": "Hash identifying source",
|
|
"misp-attribute": "ja3-fingerprint-md5",
|
|
"ui-priority": 1
|
|
},
|
|
"last-seen": {
|
|
"description": "Last seen of the SSL/TLS handshake",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "datetime",
|
|
"ui-priority": 0
|
|
}
|
|
},
|
|
"description": "JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3",
|
|
"meta-category": "network",
|
|
"name": "ja3",
|
|
"required": [
|
|
"ja3-fingerprint-md5"
|
|
],
|
|
"uuid": "09b45449-5d6e-492c-a68a-cb2e188cbfac",
|
|
"version": 4
|
|
} |