Actions
Bug #3215
closedDisable ja3_hash rules if Suricata does not have ja3 support, or ja3 support is disabled.
Affected Versions:
Effort:
Difficulty:
Label:
Description
When loading rules, check if the associated Suricata application has the ability to use ja3 (check for HAVE_NSS), and then check if ja3 is enabled.
If it is determined that the Suricata instance does not have ja3 enabled, emit a warning and automatically disable ja3 rules.
Updated by Victor Julien over 4 years ago
2 things I wanted to mention:
- we added a new notation
- we had 3 more keywords that depend on ja3 support
$ ./src/suricata --list-keywords|grep ja3 - ja3.hash - ja3.string - ja3s.hash - ja3s.string
Actions