Ja3er

Query the ja3er API for MD5 hashes of JA3 fingerprints.

Data Enrichment & Threat Intelligence · Ja3er

Details

IDJa3er
ProviderJa3er
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

Query the ja3er API for MD5 hashes of JA3 fingerprints.

Configure Ja3er in Cortex

Parameter Required
Trust any certificate (not secure) False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ja3-search

Search for “User-Agents” matching an MD5 hash of a JA3 fingerprint.

Base Command

ja3-search

Input

Argument Name Description Required
JA3 MD5 hash of the JA3 fingerprint. Required

Context Output

Path Type Description
JA3.Count Number Number of times seen
JA3.Last_seen Date Last seen date
JA3.User-Agent String User-Agent

Command Example

!ja3-search JA3=dda20ec0e6a8d4279860

Context Example

{
    "JA3": {
        "dda20ec0e6a8d4279860": [
            {
                "Count": 45,
                "Last_seen": "2020-12-03 19:19:15",
                "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.60 Safari/537.36"
            },
            {
                "Count": 32,
                "Last_seen": "2021-02-11 20:41:53",
                "User-Agent": "PostmanRuntime/7.26.8"
            },
            {
                "Count": 22,
                "Last_seen": "2020-07-14 10:18:18",
                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
            }
        ]
    }
}

Human Readable Output

Search results for dda20ec0e6a8d4279860

Count Last_seen User-Agent
45 2020-12-03 19:19:15 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.60 Safari/537.36
32 2021-02-11 20:41:53 PostmanRuntime/7.26.8
22 2020-07-14 10:18:18 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36

Configuration parameters

  • insecure — Trust any certificate (not secure)

Commands (1)

  • ja3-search

    Search for "User-Agents" matching an MD5 hash of a JA3 fingerprint.

Source

Ja3er.py Ja3er.yml Ja3er_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Ja3er
commonfields:
  id: Ja3er
  version: -1
configuration:
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
description: Query the ja3er API for MD5 hashes of JA3 fingerprints.
display: Ja3er
name: Ja3er
script:
  commands:
  - arguments:
    - default: true
      description: MD5 hash of the JA3 fingerprint.
      name: JA3
      required: true
    description: Search for "User-Agents" matching an MD5 hash of a JA3 fingerprint.
    name: ja3-search
    outputs:
    - contextPath: JA3.Count
      description: Number of times seen.
      type: Number
    - contextPath: JA3.Last_seen
      description: Last seen date.
      type: Date
    - contextPath: JA3.User-Agent
      description: User-Agent.
      type: String
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)