CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-03-17 18:25:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add SOC UI toggle for JA4+ fingerprinting in Zeek

Browse Source 
JA4 (BSD licensed) remains always enabled, but JA4+ variants (JA4S,
JA4D, JA4H, JA4L, JA4SSH, JA4T, JA4TS, JA4X) require a FoxIO license
and are now toggleable via the SOC UI. The toggle includes a license
agreement warning and defaults to disabled.
This commit is contained in:
Mike Reeves
2026-03-17 09:35:31 -04:00
parent 70597a77ab
commit 6809497730
4 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
salt/zeek/config.sls
View File

@@ -156,6 +156,9 @@ zeekja4cfg:
- source: salt://zeek/files/config.zeek.ja4
- user: 937
- group: 939
- template: jinja
- defaults:
JA4PLUS_ENABLED: {{ ZEEKMERGED.ja4plus_enabled }}
# BPF compilation failed
{% if ZEEKBPF and not ZEEK_BPF_STATUS %}

1
salt/zeek/defaults.yaml
View File

@@ -1,5 +1,6 @@
zeek:
enabled: False
ja4plus_enabled: False
config:
node:
lb_procs: 0

22
salt/zeek/files/config.zeek.ja4
View File

@@ -8,20 +8,20 @@ export {
option JA4_raw: bool = F;
# FoxIO license required for JA4+
option JA4S_enabled: bool = F;
option JA4S_raw: bool = F;
option JA4S_enabled: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4S_raw: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4D_enabled: bool = F;
option JA4D_enabled: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4H_enabled: bool = F;
option JA4H_raw: bool = F;
option JA4H_enabled: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4H_raw: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4L_enabled: bool = F;
option JA4SSH_enabled: bool = F;
option JA4L_enabled: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4T_enabled: bool = F;
option JA4TS_enabled: bool = F;
option JA4SSH_enabled: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4X_enabled: bool = F;
option JA4T_enabled: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4TS_enabled: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
option JA4X_enabled: bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
}

4
salt/zeek/soc_zeek.yaml
View File

@@ -2,6 +2,10 @@ zeek:
enabled:
description: Controls whether the Zeek (network packet inspection) process runs. Disabling this process could result in loss of network protocol metadata. If Suricata was selected as the protocol metadata engine during setup then this will already be disabled.
helpLink: zeek.html
ja4plus_enabled:
description: "Enables JA4+ fingerprinting (JA4S, JA4D, JA4H, JA4L, JA4SSH, JA4T, JA4TS, JA4X). By enabling this, you agree to the terms of the JA4+ license (https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE-JA4)."
forcedType: bool
helpLink: zeek.html
config:
local:
load: