integrate JA4 zeek plugin

[mmguero]

integrate JA4.

Not sure if this repo or this repo is the one we should use?

[mmguero]

Also, is this supplementing or replacing JA3?

[piercema]

This will replace JA3.
"JA4+ provides a suite of modular network fingerprints that are easy to use and easy to share, replacing the JA3 TLS fingerprinting standard from 2017. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis." Source.

The FoxIO repo is company maintained. We will use this version of the package.

[mmguero]

Good blog post:

https://blog.foxio.io/ja4%2B-network-fingerprinting

[mmguero]

Arkime JA4 fields (will be in v24.04.0 of Malcolm):