search

salesforce / ja3

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.
BSD 3-Clause "New" or "Revised" License
2.61k stars 289 forks source link

No JA3 hash in logs #77

Open Pooshkis opened 2 years ago

Pooshkis commented 2 years ago

Installed plugin by the instructions, when running scripts -c in zeekctl I do get

{"name":"  /opt/zeek/share/zeek/site/ja3/__load__.zeek"}
{"name":"    /opt/zeek/share/zeek/site/ja3/ja3.zeek"}
{"name":"    /opt/zeek/share/zeek/site/ja3/intel_ja3.zeek"}
{"name":"    /opt/zeek/share/zeek/site/ja3/ja3s.zeek"}

but don't have anything in ssl.log and can't figure out where to look for problems (if they exists)