category: Data Enrichment & Threat Intelligence
provider: Salesforce
sectionorder:
- Connect
- Collect
commonfields:
  id: JARM
  version: -1
configuration:
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: 'Active TLS fingerprinting using JARM.'
display: JARM
name: JARM
script:
  commands:
  - arguments:
    - description: 'FQDN or IP address to fingerprint. Also supports [https://fqdn:port] format.'
      name: host
      required: true
    - description: 'Port to fingerprint. If provided overrides the port specified in the host parameter.'
      name: port
      defaultValue: 443
    description: 'Calculate JARM fingerprint by scanning host with multiple TLS packets.'
    name: jarm-fingerprint
    outputs:
    - contextPath: JARM.FQDN
      description: 'FQDN of the host.'
      type: String
    - contextPath: JARM.IP
      description: 'IP Address of the host.'
      type: String
    - contextPath: JARM.Port
      description: 'TCP port.'
      type: Number
    - contextPath: JARM.Target
      description: 'The host in the format [IP or FQDN]:Port.'
      type: Number
    - contextPath: JARM.Fingerprint
      description: 'JARM fingerprint of the host.'
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/py3-tools:1.0.0.10120494
fromversion: 5.0.0
tests:
- JARM-Test