EDR: How Is JA3 Support Enabled In The EDR Console?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How is JA3 support enabled in the EDR console?

Environment

• EDR Server: Version 7.1.0 and Higher
• EDR Windows Sensor: Version 7.0 and Higher
• Microsoft Windows: All Supported Versions

Resolution

JA3 support automatically begins when both the server and Windows sensor are upgraded to versions that support JA3: EDR Server 7.1.0 and Higher, and EDR Windows Sensor 7.0 and Higher.

Additional Information

If JA3 fingerprints seem to be absent in netconn data, do a process search for ja3:* over a period of a couple of weeks to confirm JA3 data is being captured in the EDR console.