From 05a368681a6d76f085357fe37de3a5635d4a8e06 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 21 Jul 2025 10:53:54 -0400
Subject: [PATCH] Create config.zeek.ja4

---
 salt/zeek/files/config.zeek.ja4 | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 salt/zeek/files/config.zeek.ja4

diff --git a/salt/zeek/files/config.zeek.ja4 b/salt/zeek/files/config.zeek.ja4
new file mode 100644
index 000000000..e3dd08a48
--- /dev/null
+++ b/salt/zeek/files/config.zeek.ja4
@@ -0,0 +1,25 @@
+module FINGERPRINT;
+
+export {
+  option delimiter: string = "_";
+
+  # BSD licensed
+  option JA4_enabled:    bool = T;
+  option JA4_raw:        bool = F;
+
+  # FoxIO license required for JA4+
+  option JA4S_enabled:   bool = F;
+  option JA4S_raw:   bool = F;
+
+  option JA4H_enabled:   bool = F;
+  option JA4H_raw:   bool = F;
+
+  option JA4L_enabled:   bool = F;
+  
+  option JA4SSH_enabled: bool = F;
+
+  option JA4T_enabled: bool = F;
+  option JA4TS_enabled: bool = F;
+
+  option JA4X_enabled:   bool = F;
+}