EDR: Does the Event Forwarder Support JA3 Fingerprints?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When using the Event Forwarder to send netconn data there is no JA3 fingerprints

Environment

• EDR: All Supported Versions
• CB Event Forwarder: 3.7.1 and Below

Cause

As of 3.7.1 Event Forwarder does not have support for JA3 fingerprints yet

Resolution

Support for forwarding of JA3 fingerprints via Event Forwarder is planned for version 3.7.2. We will update this article when it becomes available.