Hi everyone,
I am deploying Suricata (8.0.5) in a topology where an upstream SSL proxy handles TLS termination/decryption before passing the plaintext traffic to Suricata.
Suricata Dataset would be used to support big list of malicious ja4 fingerprints.
Because Suricata only receives the decrypted packets, it does not see the original TLS handshake packets (Client Hello). Consequently, Suricata cannot natively calculate the JA4 fingerprint for these sessions.
The upstream SSL proxy is capable of calculating the JA4 fingerprint during the initial handshake.
My question: Is there an existing, standard way to pass this externally calculated JA4 fingerprint from the proxy to Suricata so that Suricata can perform a lookup against a configured dataset?
A few specific points I am trying to figure out:
- Transmission Mechanism: Can Suricata accept this metadata via a custom protocol header (e.g., encapsulating the decrypted traffic in Geneve, GRE, or a custom HTTP header) and parse it into a usable variable?
- Rule Syntax / Engine Interaction: Once passed, how can we reference this external fingerprint in a Suricata signature to trigger a dataset match (e.g., matching a
ja4.hashequivalent against a blocklist)? - Another approach, can we register a function to trigger the ja4 lookup after setting the ja4 fingerprint with the suricata as part of the flow . and suricata can perform the lookup against the dataset.
- Alternative Architecture: If this is not natively supported, what is the recommended best practice for this architecture? (e.g., sending a duplicate stream of the raw encrypted handshake traffic to a separate Suricata interface just for JA4 logging/matching?
Any insights, workarounds, or pointers to relevant documentation/plugins would be greatly appreciated!
Thanks!