From 247f2873ac4ff93743ed8ebafa19e226735cf7bc Mon Sep 17 00:00:00 2001 From: michael Date: Thu, 20 Aug 2026 16:27:41 -0700 Subject: [PATCH] feat(suricata): carry the JA4 TLS client fingerprint into the report MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Suricata computes JA4 for TLS from 8.0.0 onward when `app-layer.protocols.tls.ja4-fingerprints` is enabled, and logs it in the eve.json `tls` record — `LOG_TLS_FIELD_JA4` is part of `EXTENDED_FIELDS`, so the existing `extended: yes` eve-log output emits it with no further output configuration. `tls_items` is the allowlist that decides which eve `tls` keys are copied into the CAPE report (see the loop below at the `event_type == "tls"` branch), so without "ja4" here Suricata computes the fingerprint and the processing module immediately discards it. Unlike ja3/ja3s, which are `{hash, string}` objects, ja4 is a plain string. The tuple is exploded across lines because appending "ja4" takes the single line to 133 characters, past the 132 configured for black/ruff/flake8. --- modules/processing/suricata.py | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/modules/processing/suricata.py b/modules/processing/suricata.py index c848cf3ab3b..57fdbf3c3bf 100644 --- a/modules/processing/suricata.py +++ b/modules/processing/suricata.py @@ -98,7 +98,19 @@ def run(self): "dns_log_full_path": None, } - tls_items = ("fingerprint", "issuerdn", "version", "subject", "sni", "ja3", "ja3s", "serial", "notbefore", "notafter") + tls_items = ( + "fingerprint", + "issuerdn", + "version", + "subject", + "sni", + "ja3", + "ja3s", + "ja4", + "serial", + "notbefore", + "notafter", + ) SURICATA_ALERT_LOG_FULL_PATH = f"{self.logs_path}/{SURICATA_ALERT_LOG}" SURICATA_TLS_LOG_FULL_PATH = f"{self.logs_path}/{SURICATA_TLS_LOG}"