How to enable JA4 metadata attributes in Security Analytics

Products

• Security Analytics

Issue/Introduction

Security Analytics provides a common set of metadata attributes that can be indexed on any traffic that is captured.  JA4 is a modern cybersecurity standard used to fingerprint and identify the software and devices making encrypted network connections, such as web browsers, mobile apps, or malicious bots. It replaces the older JA3 method by being more accurate, resilient to evasion, and easier for humans to read. 

JA3 is available by default, but JA4 needs to be enabled manually.

Environment

Security Analytics 8.3.1
Security Analytics 8.4.1

Resolution

1. Log in to the CLI as root
2. cd /home
3. create a new file called 'ja4_attributes_patch.json'
   
   touch ja4_attributes_patch.json
   
   
4. Open the file using 'vi' and paste the entire contents below including the curley braces:
   

   {
    "delete_columns": [
        "ja4_fingerprint"
    ],
    "add_columns": [
        {
            "name": "ja4_fingerprint",
            "attributes": [
                "ssl:fingerprint_ja4"
            ],
            "uiGroup": "encryptionGroup",
            "optional": true
        }
    ],
    "delete_enabled": [

       ],
    "add_enabled": [
    ]
}

5. Save the file using :wq
6. Make a backup of the existing attributes.json file
   
   cp -p /etc/solera/meta/attributes.json /home/attributes_$(date +%Y-%m-%d__%H_%M_%S).json
   
   
7. Apply the JA4 patch
   
   /usr/local/bin/apply_attributes_patch /home/ja4_attributes_patch.json -o /home/attributes_with_ja4.json;
   
   
8. Format the ja4_attributes.json file
   
   cat /home/attributes_with_ja4.json | /usr/bin/json_reformat > /home/attributes_with_ja4_formatted.json;
   
   
9. Copy over the new attributes.json file ('Y' to overwrite)
   
   cp /home/attributes_with_ja4_formatted.json /etc/solera/meta/attributes.json;
   
   
10. Clear the GUI cache
    
    scm db clear_redis
    
    
11. Using the Security Analytics GUI, turn on ja4_fingerprint under the Settings > Metadata > Encryption section
    
    
    
    
12. Click Save at the bottom of the page
13. Capture some traffic that includes JA4 information (which should be any HTTPS traffic)

You may need to add the 'ja4_fingerprint' column to the Session or Subsession reports you are running.  Click Actions > Add/Edit Columns and locate 'ja4_fingerprint' in the Available Colums list and move it to the Selected Columns list.  

You can also run a dedicated report against ja4_fingerprint by going to Analyze > Reports > Encryption > ja4_fingerprint

NOTE:  ja4_fingerprint does not show up on the reports page in the GUI until:

• A session has been captured that would contain a ja4 (Any HTTPS session)
• And the GUI cache (scm db clear_redis) has been cleared or timed out. GUI cache timeout is 3600 seconds (1 hour.)
  
  

Additional Information