Ja3er

Query the ja3er API for MD5 hashes of JA3 fingerprints.

Data Enrichment & Threat Intelligence · Ja3er

Details

IDJa3er
ProviderJa3er
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

Query the ja3er API for MD5 hashes of JA3 fingerprints.

Configure Ja3er in Cortex

Parameter Required
Trust any certificate (not secure) False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ja3-search

Search for “User-Agents” matching an MD5 hash of a JA3 fingerprint.

Base Command

ja3-search

Input

Argument Name Description Required
JA3 MD5 hash of the JA3 fingerprint. Required

Context Output

Path Type Description
JA3.Count Number Number of times seen
JA3.Last_seen Date Last seen date
JA3.User-Agent String User-Agent

Command Example

!ja3-search JA3=dda20ec0e6a8d4279860

Context Example

{
    "JA3": {
        "dda20ec0e6a8d4279860": [
            {
                "Count": 45,
                "Last_seen": "2020-12-03 19:19:15",
                "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.60 Safari/537.36"
            },
            {
                "Count": 32,
                "Last_seen": "2021-02-11 20:41:53",
                "User-Agent": "PostmanRuntime/7.26.8"
            },
            {
                "Count": 22,
                "Last_seen": "2020-07-14 10:18:18",
                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
            }
        ]
    }
}

Human Readable Output

Search results for dda20ec0e6a8d4279860

Count Last_seen User-Agent
45 2020-12-03 19:19:15 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.60 Safari/537.36
32 2021-02-11 20:41:53 PostmanRuntime/7.26.8
22 2020-07-14 10:18:18 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36

Configuration parameters

  • insecure — Trust any certificate (not secure)

Commands (1)

  • ja3-search

    Search for "User-Agents" matching an MD5 hash of a JA3 fingerprint.

Source

Ja3er.py Ja3er.yml Ja3er_description.md
Download History Raw 
import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

import urllib3

# Disable insecure warnings
urllib3.disable_warnings()


class Client(BaseClient):
    pass


def test_module(client: Client, **args) -> str:
    uri = "/json"
    client._http_request("GET", uri)

    return "ok"


def ja3_search(client: Client, **args) -> CommandResults:
    ja3 = args.get("JA3")
    uri = f"search/{ja3}"
    r = client._http_request("GET", uri)

    results = CommandResults(
        outputs_prefix="JA3",
        outputs_key_field="JA3",
        outputs={ja3: r},
        readable_output=tableToMarkdown(f"Search results for {ja3}", r),
    )

    return results


def main():
    args = {**demisto.params(), **demisto.args()}

    base_url = "https://ja3er.com/"
    verify = not args.get("insecure", False)

    client = Client(base_url, verify=verify)

    commands = {"test-module": test_module, "ja3-search": ja3_search}

    command = demisto.command()
    if command in commands:
        return_results(commands[command](client, **args))
    else:
        return_error(f"Command {command} is not available in this integration")


if __name__ in ["__main__", "__builtin__", "builtins"]:
    main()