JARM

Details

ID	`JARM`
Provider	Salesforce
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/py3-tools:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Active TLS fingerprinting using JARM

Configure JARM in Cortex

Parameter	Required
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

jarm-fingerprint

Calculate JARM fingerprint by scanning host with multiple TLS packets.

Base Command

jarm-fingerprint

Input

Argument Name	Description	Required
host	FQDN or IP address to fingerprint. Also supports [https://fqdn:port] format.	Required
port	Port to fingerprint. If provided overrides the port specified in the host parameter. Default is 443.	Optional

Context Output

Path	Type	Description
JARM.FQDN	String	FQDN of the host.
JARM.IP	String	IP Address of the host.
JARM.Port	Number	TCP port
JARM.Target	String	The host in the format [IP or FQDN]:Port
JARM.Fingerprint	String	JARM fingerprint of the host.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.

Command Example

!jarm-fingerprint host="google.com" port=443

Context Example

{
    "DBotScore": [
        {
            "Indicator": "27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d",
            "Score": 0,
            "Type": "jarm",
            "Vendor": "JARM"
        }
    ],
    "JARM": {
        "FQDN": "google.com",
        "Fingerprint": "27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d",
        "Port": 443,
        "Target": "google.com:443"
    }
}

Human Readable Output

Results

FQDN Fingerprint Port Target

google.com 27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d 443 google.com:443

FQDN	Fingerprint	Port	Target
google.com	27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d	443	google.com:443

Configuration parameters

proxy — Use system proxy settings

Commands (1)

jarm-fingerprint
Calculate JARM fingerprint by scanning host with multiple TLS packets.

Source

JARM.py JARM_test.py JARM.yml JARM_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Salesforce
sectionorder:
- Connect
- Collect
commonfields:
  id: JARM
  version: -1
configuration:
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: 'Active TLS fingerprinting using JARM.'
display: JARM
name: JARM
script:
  commands:
  - arguments:
    - description: 'FQDN or IP address to fingerprint. Also supports [https://fqdn:port] format.'
      name: host
      required: true
    - description: 'Port to fingerprint. If provided overrides the port specified in the host parameter.'
      name: port
      defaultValue: 443
    description: 'Calculate JARM fingerprint by scanning host with multiple TLS packets.'
    name: jarm-fingerprint
    outputs:
    - contextPath: JARM.FQDN
      description: 'FQDN of the host.'
      type: String
    - contextPath: JARM.IP
      description: 'IP Address of the host.'
      type: String
    - contextPath: JARM.Port
      description: 'TCP port.'
      type: Number
    - contextPath: JARM.Target
      description: 'The host in the format [IP or FQDN]:Port.'
      type: Number
    - contextPath: JARM.Fingerprint
      description: 'JARM fingerprint of the host.'
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/py3-tools:1.0.0.10120494
fromversion: 5.0.0
tests:
- JARM-Test