feat: Add JA3/S and JA4 hashing algorithms.

[xg5-simon]

An increasing number of EDR products (AFAIK - Carbon Black & MDE) are capable of network level inspection and calculating JA3 to identify malicious network communication. This feature request proposes adding JA3 and JA4 to hashing algorithms.

[tsale]

Can you show me a screenshot of CB and MDE that contain those hashes?

[jonade]

@tsale For MDE the JA3 / JA3S hashes are stored in the DeviceNetworkEvents table:

[joshlemon]

Can confirm that Uptycs also collects JA3 telemetry for SSL connections.

This could be a helpful feature, especially with the challenges of so few EDRs having HTTP visibility. One challenge we might have is that JA3 has some known issues, and JA4 is really the standard that should be used now.

Alternatively, if an EDR captures the HELO SSL traffic, they can generate the JAR3/4 with that data.

[tsale]

We're exploring the possibility of adding this as a new sub-category and marking the EDRs mentioned in this thread as implemented.

@joshlemon & @xg5-simon - Could you please provide some evidence here or to me privately?

[tsale]

Implemented - #122 - Thank you, everyone!!