JA4+ Fingerprint
ja4_fingerprint
The JA4+ fingerprint object provides detailed fingerprint information about various aspects of network traffic which is both machine and human readable.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Raw Data | raw_data | JSON | Group:contextThe event data as received from the event source. |
| Record ID | record_id | String | Group:primaryUnique identifier for the object |
| JA4 Section A | section_a | String | The 'a' section of the JA4 fingerprint. |
| JA4 Section B | section_b | String | The 'b' section of the JA4 fingerprint. |
| JA4 Section C | section_c | String | The 'c' section of the JA4 fingerprint. |
| JA4 Section D | section_d | String | The 'd' section of the JA4 fingerprint. |
| Type | type | String | The JA4+ fingerprint type as defined by FoxIO, normalized to the caption of 'type_id'. In the case of 'Other', it is defined by the event source. |
| Type ID | type_id | Integer | The identifier of the JA4+ fingerprint type.
|
| Unmapped | unmapped | Unmapped[] | Data from the source that was not mapped into the schema. |
| Value | value | String | The JA4+ fingerprint value. |
Relationships
Inbound Relationships
These objects and events reference JA4+ Fingerprint in their attributes:
- DHCP Activity
- Network Activity
- RDP Activity
- Windows Evidence Artifacts
- Network File Activity
- NTP Activity
- SMB Activity
- Tunnel Activity
- DNS Activity
- FTP Activity
- HTTP Activity
- SSH Activity
Outbound Relationships
JA4+ Fingerprint references the following objects and events in its attributes:
This page describes qdm-1.5.1+ocsf-1.6.0
Updated about 2 months ago
Did this page help you?