EDR: How Is JA3 Support Enabled In The EDR Console?
book
Article ID: 287157
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How is JA3 support enabled in the EDR console?
Environment
EDR Server: Version 7.1.0 and Higher
EDR Windows Sensor: Version 7.0 and Higher
Microsoft Windows: All Supported Versions
Resolution
JA3 support automatically begins when both the server and Windows sensor are upgraded to versions that support JA3: EDR Server 7.1.0 and Higher, and EDR Windows Sensor 7.0 and Higher.
Additional Information
If JA3 fingerprints seem to be absent in netconn data, do a process search for ja3:* over a period of a couple of weeks to confirm JA3 data is being captured in the EDR console.