FEATURE: SNI beacons for RITA

[maxwets]

Currently, the RITA module only parses the following files in /nsm/rita:

• long-connections.csv
• beacons.csv
• exploded-dns.csv

RITA also supports the show-beacons-sni command (see RITA PR 739) that detects beaconing using TLS server name identification / HTTP Host.

[weslambert]

If you can provide sample logs we can look at including it in the future.

[maxwets]

I just made a PR for this issue. The output of rita show-beacons-sni is a CSV containing the following columns (this output is exactly the same as for show-beacons, except for the third column (SNI): Score,Source IP,SNI,Connections,Avg. Bytes,Total Bytes,TS Score,DS Score,Dur Score,Hist Score,Top Intvl