Ctiscan datamodel
Design
Our historic data model needed refactoring. We could have changed and improved it, but that would have impacted all current users and customers. So, we decided to craft an all new data model, along with a brand new information category dedicated to threat hunters. That’s why we have focused on including lots of pivots and technical indicators in this new data model.
Some key features of this new design:
- no nested fields to avoid losing context when searching
- set fields in a predictible format, for example, values are always arrays or never arrays (for Python lovers)
- data model shoud be easily extensible: adding a new field should be straightforward without breaking anything
- a single document should contain everything needed for easy pivoting, thus we merge multiple scanning steps into one document
- sometimes you need both exact searches & full-text searches on the same field, so we included both where it’s useful.
The main idea is to store every data field in a layer. Each layer is dedicated to providing information from a set of related concepts. For instance, you will find all IP-related data at the ip layer. The same is true for TCP.
In a break from our historical approach, we decided to split the application layer into different parts. The app layer is where you’ll find information on application responses, without protocol related information. For instance, you will find app.data.text where the raw application response is stored. The app.protocol field is set according to the specifics of the raw application response, and a related new layer is created. For example, if app.protocol is set to http, an http layer will be created.
It’s also possible to have chained layers. By analyzing the http layer, you may find a favicon. The favicon data and attributes are stored in the favicon layer, and not within http layer. The same is true for tls or other certificate data, which again is stored in a separate layer. In the end, depending on the detected protocol, you may have a cert layer, a favicon layer, a ja3 layer or a jarm layer added.
There are also some platform-specific layers, like the scanner layer which contains information about which of our scanners collected the data. The dns layer has been split into different parts, one part for reverse DNS information and another part for forward DNS information.
One of the most powerful layers may be component. This is where you can find information about all detected hardware and software components, along with detected products, vendors and CPEs.
At the root of this data model you can find a few general fields, like source or tag, however we prefered to put the vast majority of fields in a dedicated layer.
One last comment; every field has a defined type which allows for some search techniques. Keyword type, the most used, allows for searching with exact strings, wildcards or even regexps.
That’s it, for an overview of how we decided to split the data and make it easier to understand and search for. Now, if you want to know more, you can go and read every specific detail in this page, if you have the time :)
- Keyword type allows wildcard or regex searches, but not full-text searches
- Text type allows full-text searches, but not wildcard or regex searches
- IP type allows CIDR searches, up to /8 subnets
- Boolean type allows searches with true or false values
- Float types currently doesn’t allow searches
- Geo point types currently doesn’t allow searches
- Timestamp types allows to search with a time pattern
Sample queries
Search information about an IP address
category:ctiscan ip.dest:8.8.8.8
Search a specific port exposure
category:ctiscan tcp.dest:3389
Search information on a specific domain, with DNS resolution
category:ctiscan dns.domain:onyphe.io
Search information on a specific domain, with or without DNS resolution, from certificate
category:ctiscan cert.domain:traefik.default
Search information on a specific domain, from reverse DNS resolution
category:ctiscan dns.reverse.domain:onyphe.io
Search a specific product exposure
category:ctiscan component.text:ivanti
Search for a simple string in application response
category:ctiscan app.data.text:MeshCentral
Search for a simple string within HTML title
category:ctiscan html.title.text:MeshCentral
Search for an IP address with a list of open ports
category:ctiscan services.port:80 services.port:3389 services.port:5984
Search for an IP address with a list of open ports and a specific JA4T fingerprint
Search a specific certificate subject distinguished name
Search a specific certificate subject distinguished name against a regexp
category:ctiscan app.protocol:rdp -regexp:cert.subject.dn,cn=[a-z0-9]{15}
Search a specific serial number in certificate
category:ctiscan cert.serial.num:146473198
Search a favicon hash
- category:ctiscan favicon.data.md5:“bd9e17c46bbbc18af2a2bd718dddad0e”
- category:ctiscan favicon.data.mmh3:“2019488876”
Search an HTTP header server against a given string
category:ctiscan http.header.server:“Apache/2.4.29 (Ubuntu)”
Search a specific HTTP header etag value
category:ctiscan http.header.etag:“644e8f8f-cd”
Search hash of HTTP headers, order of headers is kept
category:ctiscan http.header.data.md5:“2b72b1cfb2353e7024a445697ca93534”
Search for a specific domain with a specific string within application response
category:ctiscan dns.domain:google.com app.data.text:google
Search for a specific protocol
category:ctiscan app.protocol:rdp
Search for a specific kind of device
category:ctiscan app.device:c2
Search information on any entity
category:ctiscan entity.text:bank
Search using nested booleans, we want either port 8080 or 1723 open, but not when port 80 or 443 is also open
NOTE: requires OQLv2 enabled user account.
Layers
root layer
@category
Type: keyword
Description: the name of queries category of information.
Compatibility: datascan @category field.
@timestamp
Type: timestamp
Description: timestamp of collected data so we can track when we have seen a given information.
Compatibility: datascan @timestamp field.
tag
Type: keyword
Description: we add tags to make the data more meaningful. For instance, we can add a tag:open to states that an asset allows unauthenticated access, like for databases.
Compatibility: datascan tag field.
source
Type: keyword
Description: which of our collector process has collected a given information.
Compatibility: datascan source field.
scanner layer
scanner.name
Type: keyword
Description: the name of the scanner that has collected information.
Compatibility: datascan node.id field.
scanner.country
Type: keyword
Description: the physical country of the scanner that has collected information.
Compatibility: datascan node.physicalcountry field.
scanner.lcountry
Type: keyword
Description: the logical country of the scanner that has collected information.
Compatibility: datascan node.country field.
ip layer
ip.version
Type: numeric
Description: the version of IP address, either 4 for IPv4 or 6 for IPv6.
Compatibility: datascan ipv6 field.
ip.ttl
Type: numeric
Description: the time-to-live of the IP header returned by the target.
Compatibility: datascan ttl field.
ip.src
Type: IP
Description: the source IP address of the scanner that has collected information.
Compatibility: datascan srcip field.
ip.dest
Type: IP
Description: the destination IP address, meaning the IP address of the collected asset.
Compatibility: datascan ip field.
ip.netname
Type: keyword
Description: netname information for given IP address (ip.dest), data we correlate using whois queries.
Compatibility: datascan geolocus.netname field.
ip.asn
Type: keyword
Description: physical asn information for given IP address (ip.dest).
Compatibility: datascan asn field.
ip.organization
Type: keyword
Description: physical hosting organization for given IP address (ip.dest).
Compatibility: datascan organization field.
ip.subnet
Type: keyword
Description: physical hosting subnet for given IP address (ip.dest).
Compatibility: datascan subnet field.
ip.country
Type: keyword
Description: physical country for given IP address (ip.dest).
Compatibility: datascan country field.
ip.latitude
Type: float
Description: physical latitude for given IP address (ip.dest). We only keep the country level precision, not the city level precision.
Compatibility: datascan latitude field.
ip.longitude
Type: float
Description: physical longitude for given IP address (ip.dest). We only keep the country level precision, not the city level precision.
Compatibility: datascan longitude field.
ip.location
Type: geo point
Description: physical GPS coordinates for given IP address (ip.dest). We only keep the country level precision, not the city level precision.
Compatibility: datascan location field.
ip.lasn
Type: keyword
Description: logical asn information for given IP address (ip.dest), data we correlate using whois queries.
Compatibility: datascan geolocus.asn field.
ip.lorganization
Type: keyword
Description: logical hosting organization for given IP address (ip.dest); data we correlate using whois queries.
Compatibility: datascan geolocus.organization field.
ip.lsubnet
Type: keyword
Description: logical hosting subnet for given IP address (ip.dest), data we correlate using whois queries.
Compatibility: datascan geolocus.subnet field.
ip.lcountry
Type: keyword
Description: logical country for given IP address (ip.dest), data we correlate using whois queries.
Compatibility: datascan geolocus.country field.
ip.llatitude
Type: float
Description: logical latitude for given IP address (ip.dest), data we correlate using whois queries. We only keep the country level precision, not the city level precision.
Compatibility: datascan geolocus.latitude field.
ip.llongitude
Type: float
Description: logical longitude for given IP address (ip.dest), data we correlate using whois queries. We only keep the country level precision, not the city level precision.
Compatibility: datascan geolocus.longitude field.
ip.llocation
Type: geo point
Description: logical GPS coordinates for given IP address (ip.dest), data we correlate using whois queries. We only keep the country level precision, not the city level precision.
Compatibility: datascan geolocus.location field.
tcp layer
tcp.src
Type: numeric
Description: the source port used during the TCP connection to the remote address (ip.dest).
Compatibility: datascan srcport field.
tcp.dest
Type: numeric
Description: the destination port that has been connected with remote address (ip.dest).
Compatibility: datascan port field.
tcp.rtt
Type: numeric
Description: round-trip time taken to establish the TCP connection.
Compatibility: datascan rtt field.
tcp.cpe
Type: keyword
Description: CPE associated with operating system that has been fingerprinted, at the TCP and application layers.
Compatibility: datascan cpe field.
tcp.vendor
Type: keyword
Description: vendor associated with fingerprinted operating system.
Compatibility: datascan osvendor field.
tcp.product
Type: keyword
Description: product associated with fingerprinted operating system.
Compatibility: datascan osproduct field.
tcp.fingerprint.raw
Type: keyword
Description: the raw operating system fingerprint at TCP layer.
Compatibility: not applicable.
tcp.fingerprint.md5
Type: keyword
Description: md5 hash of raw operating system fingerprint at TCP layer (tcp.fingerprint.raw).
Compatibility: not applicable.
tcp.options
Type: keyword
Description: TCP options identified at the TCP layer.
Compatibility: not applicable.
tcp.window
Type: keyword
Description: TCP window identified at the TCP layer.
Compatibility: not applicable.
app layer
app.device
Type: keyword
Description: identified device class. For instance, a couple ip.dest/tcp.dest may be identified as a “vpn server” or a “database”.
Compatibility: datascan device.class field.
app.protocol
Type: keyword
Description: detected protocol during the TCP communication. For instance, “http” or “rdp”.
Compatibility: datascan protocol field.
app.transport
Type: keyword
Description: transport used for collecting information. Can be either “udp” or “tcp”.
Compatibility: datascan transport field.
app.tls
Type: boolean
Description: whether a TLS negociation was performed or not.
Compatibility: datascan tls field.
app.data.text
Type: text
Description: the raw application response we received. We keep up to 1MB of data.
Compatibility: datascan data field.
app.data.length
Type: numeric
Description: the length of collected raw application response.
Compatibility: datascan app.length field.
app.data.md5
Type: text
Description: md5 hash of collected raw application response.
Compatibility: datascan datamd5 field.
app.data.mmh3
Type: numeric
Description: mmh3 hash of collected raw application response.
Compatibility: datascan datammh3 field.
extract layer
extract.url
Type: keyword
Description: when URLs are found in an application response, we keep them in this field.
Compatibility: datascan app.extract.url field.
extract.domain
Type: keyword
Description: when URLs are found in an application response, we keep them in this field, and we extract found domain names to put them in this field.
Compatibility: datascan app.extract.domain field.
extract.hostname
Type: keyword
Description: when URLs are found in an application response, we keep them in this field, and we extract found hostnames to put them in this field.
Compatibility: datascan app.extract.hostname field.
extract.file
Type: keyword
Description: when files are found in an application response, we keep them in this field.
Compatibility: datascan app.extract.file field.
extract.ip
Type: IP
Description: when IP addresses are found in an application response, we keep them in this field.
Compatibility: datascan app.extract.ip field.
dns layer
dns.hostname
Type: keyword
Description: hostname that has a DNS resolution.
Compatibility: datascan hostname field.
dns.domain
Type: keyword
Description: domain name associated with a hostname that has a DNS resolution.
Compatibility: datascan domain field.
dns.idomain
Type: keyword
Description: intermediate domain name associated with a hostname that has a DNS resolution.
Compatibility: datascan subdomains field.
dns.tld
Type: keyword
Description: top-level domain associated with a hostname that has a DNS resolution.
Compatibility: datascan tld field.
dns.host
Type: keyword
Description: host part associated with a hostname that has a DNS resolution. For instance, “www” or “vpn”.
Compatibility: datascan host field.
dns.reverse.hostname
Type: keyword
Description: reverse DNS hostname associated with a hostname that has a DNS resolution.
Compatibility: datascan reverse field.
dns.reverse.domain
Type: keyword
Description: reverse DNS domain name associated with a hostname that has a DNS resolution.
Compatibility: not applicable.
dns.reverse.idomain
Type: keyword
Description: intermediate reverse DNS domain name associated with a hostname that has a DNS resolution.
Compatibility: not applicable.
dns.reverse.tld
Type: keyword
Description: top-level reverse DNS domain associated with a hostname that has a DNS resolution.
Compatibility: not applicable.
dns.reverse.host
Type: keyword
Description: reverse DNS host part associated with a hostname that has a DNS resolution. For instance, “www” or “vpn”.
Compatibility: not applicable.
dns.forward.hostname
Type: keyword
Description: forward DNS hostname associated with a hostname that has a DNS resolution.
Compatibility: not applicable.
dns.forward.domain
Type: keyword
Description: forward DNS domain name associated with a hostname that has a DNS resolution.
Compatibility: not applicable.
dns.forward.idomain
Type: keyword
Description: intermediate forward DNS domain name associated with a hostname that has a DNS resolution.
Compatibility: not applicable.
dns.forward.tld
Type: keyword
Description: top-level forward DNS domain associated with a hostname that has a DNS resolution.
Compatibility: not applicable.
dns.forward.host
Type: keyword
Description: forward DNS host part associated with a hostname that has a DNS resolution. For instance, “www” or “vpn”.
Compatibility: not applicable.
cert layer
cert.hostname
Type: keyword
Description: complete list of found FQDNs from certificate common name (cert.subject.cn) and alternative names (cert.subject.an).
Compatibility: datascan hostname field.
cert.domain
Type: keyword
Description: comple list of found domains extracted from certificate common name (cert.subject.cn) and alternative names (cert.subject.an).
Compatibility: datascan domain field.
cert.idomain
Type: keyword
Description: comple list of found intermediate domains extracted from certificate common name (cert.subject.cn) and alternative names (cert.subject.an).
Compatibility: datascan subdomains field.
cert.tld
Type: keyword
Description: comple list of found top-level domains extracted from certificate common name (cert.subject.cn) and alternative names (cert.subject.an).
Compatibility: datascan tld field.
cert.host
Type: keyword
Description: comple list of found host part extracted from certificate common name (cert.subject.cn) and alternative names (cert.subject.an). For instance, “www” or “vpn”.
Compatibility: datascan host field.
cert.serial.hex
Type: keyword
Description: certificate serial number in hexadecimal format.
Compatibility: datascan serial field.
cert.serial.num
Type: numeric
Description: certificate serial number in numeric format.
Compatibility: not applicable.
cert.validity.notbefore
Type: timestamp
Description: start date of certificate.
Compatibility: datascan validity.notbefore field.
cert.validity.notafter
Type: timestamp
Description: expiration date of certificate.
Compatibility: datascan validity.notafter field.
cert.fingerprint.md5
Type: keyword
Description: md5 hash of certificate fingerprint.
Compatibility: datascan fingerprint.md5 field.
cert.fingerprint.sha1
Type: keyword
Description: sha1 hash of certificate fingerprint.
Compatibility: datascan fingerprint.sha1 field.
cert.fingerprint.sha256
Type: keyword
Description: sha256 hash of certificate fingerprint.
Compatibility: datascan fingerprint.sha256 field.
cert.issuer.dn
Type: keyword
Description: distinguished name for certificate issuer.
Compatibility: not applicable.
cert.issuer.cn
Type: keyword
Description: common name for certificate issuer.
Compatibility: datascan issuer.commonname field.
cert.issuer.an
Type: keyword
Description: alternative names for certificate issuer.
Compatibility: datascan issuer.altname field.
cert.issuer.o
Type: keyword
Description: organization for certificate issuer.
Compatibility: datascan issuer.organization field.
cert.issuer.ou
Type: keyword
Description: organizational unit for certificate issuer.
Compatibility: datascan issuer.organizationalunit field.
cert.issuer.c
Type: keyword
Description: city for certificate issuer.
Compatibility: datascan issuer.city field.
cert.issuer.l
Type: keyword
Description: locality for certificate issuer.
Compatibility: not applicable.
cert.issuer.st
Type: keyword
Description: state for certificate issuer.
Compatibility: not applicable.
cert.issuer.e
Type: keyword
Description: email for certificate issuer.
Compatibility: datascan issuer.email field.
cert.subject.dn
Type: keyword
Description: distinguished name for certificate subject.
Compatibility: not applicable.
cert.subject.cn
Type: keyword
Description: common name for certificate subject.
Compatibility: datascan subject.commonname field.
cert.subject.an
Type: keyword
Description: alternative names for certificate subject.
Compatibility: datascan subject.altname field.
cert.subject.o
Type: keyword
Description: organization for certificate subject.
Compatibility: datascan subject.organization field.
cert.subject.ou
Type: keyword
Description: organizational unit for certificate subject.
Compatibility: datascan subject.organizationalunit field.
cert.subject.c
Type: keyword
Description: city for certificate subject.
Compatibility: datascan subject.city field.
cert.subject.l
Type: keyword
Description: locality for certificate subject.
Compatibility: not applicable.
cert.subject.st
Type: keyword
Description: state for certificate subject.
Compatibility: not applicable.
cert.subject.e
Type: keyword
Description: email for certificate subject.
Compatibility: datascan subject.email field.
entity layer
entity.raw
Type: keyword
Description: an extract of various strings found in the complete document that can be used to search with specific keywords to match data of interest. Can be used for attack surface discovery purposes.
Compatibility: not applicable.
entity.text
Type: text
Description: an extract of various strings found in the complete document that can be used to search with specific keywords to match data of interest. Can be used for attack surface discovery purposes.
Compatibility: not applicable.
entity.count
Type: numeric
Description: total number of discovered entities.
Compatibility: not applicable.
ja4t layer
ja4t.fingerprint.raw
Type: keyword
Description: JA4T fingerprint at TCP layer.
Compatibility: not applicable.
ja4t.fingerprint.md5
Type: keyword
Description: md5 hash of JA4T fingerprint at TCP layer.
Compatibility: not applicable.
component layer
component.text
Type: text
Description: all identified operating system, software and hardware components that can be searched using keywords.
Compatibility: not applicable.
component.cpe
Type: keyword
Description: CPEs for all identified operating system, software and hardware components.
Compatibility: datascan cpe field.
component.vendor
Type: keyword
Description: all identified operating system, software and hardware vendors that can be searched using keywords.
Compatibility: not applicable.
component.product
Type: keyword
Description: all identified operating system, software and hardware products that can be searched using keywords.
Compatibility: not applicable.
component.version
Type: keyword
Description: all identified operating system, software and hardware versions that can be searched using keywords.
Compatibility: not applicable.
component.patch
Type: keyword
Description: all identified operating system, software and hardware patchs level that can be searched using keywords.
Compatibility: not applicable.
component.distribution
Type: keyword
Description: all identified operating system distributions that can be searched using keywords.
Compatibility: not applicable.
component.count
Type: numeric
Description: total number of identified operating system, software and hardware components.
Compatibility: not applicable.
http layer
http.version
Type: keyword
Description: identified HTTP protocol version. For instance, “1.0” or “1.1”.
Compatibility: datascan protocolversion field.
http.code
Type: numeric
Description: HTTP status code returned by target.
Compatibility: datascan status field.
http.url
Type: keyword
Description: HTTP URL that has been scanned.
Compatibility: datascan url field.
http.defang
Type: keyword
Description: complete defanged HTTP URL that has been scanned.
Compatibility: not applicable.
http.undefang
Type: keyword
Description: complete undefanged HTTP URL that has been scanned.
Compatibility: not applicable.
http.header.data.md5
Type: keyword
Description: md5 hash of HTTP header part.
Compatibility: datascan app.http.headermd5 field.
http.header.data.mmh3
Type: numeric
Description: mmh3 hash of HTTP header part.
Compatibility: datascan app.http.headermmh3 field.
http.body.data.md5
Type: keyword
Description: md5 hash of HTTP body part.
Compatibility: datascan app.http.bodymd5 field.
http.body.data.mmh3
Type: numeric
Description: mmh3 hash of HTTP body part.
Compatibility: datascan app.http.bodymmh3 field.
NOTE only keyword types below, so no .raw or .text. If you need full-text search here, you should use app.data.text field.
http.header.etag
Type: keyword
Description: HTTP E-Tag header.
Compatibility: not applicable.
http.header.lastmodified
Type: keyword
Description: HTTP Last-Modified header.
Compatibility: not applicable.
http.header.wwwauthenticate
Type: keyword
Description: HTTP WWW-Authenticate header.
Compatibility: not applicable.
http.header.realm
Type: keyword
Description: HTTP realm extracted from WWW-Authenticate header.
Compatibility: not applicable.
http.header.cookie
Type: keyword
Description: HTTP Cookie header.
Compatibility: not applicable.
http.header.contentlength
Type: numeric
Description: HTTP Content-Length header.
Compatibility: not applicable.
http.vhost
Type: keyword
Description: virtual host that has been scanned.
Compatibility: datascan forward field.
redirect layer
redirect.type
Type: keyword
Description: when a redirection has been followed, this describes which kind of redirection was followed.
Compatibility: not applicable.
redirect.src
Type: keyword
Description: when a redirection has been followed, this field sets the source of the redirection.
Compatibility: not applicable.
redirect.dest
Type: keyword
Description: when a redirection has been followed, this field sets the destination of the redirection.
Compatibility: not applicable.
html layer
html.title.raw
Type: keyword
Description: HTML title of the Web page in raw format.
Compatibility: datascan app.http.title.keyword field.
html.title.text
Type: text
Description: HTML title of the Web page searchable using keywords.
Compatibility: datascan app.http.title field.
html.keywords.raw
Type: keyword
Description: HTML keywords of the Web page in raw format.
Compatibility: datascan app.http.keywords.keyword field.
html.keywords.text
Type: text
Description: HTML keywords of the Web page searchable using keywords.
Compatibility: datascan app.http.keywords field.
html.description.raw
Type: keyword
Description: HTML description of the Web page in raw format.
Compatibility: datascan app.http.description.keyword field.
html.description.text
Type: text
Description: HTML description of the Web page searchable using keywords.
Compatibility: datascan app.http.description field.
html.copyright.raw
Type: keyword
Description: HTML copyright of the Web page in raw format.
Compatibility: datascan app.http.copyright.keyword field.
html.copyright.text
Type: text
Description: HTML copyright of the Web page searchable using keywords.
Compatibility: datascan app.http.copyright field.
ROADMAP html.ssdeep
ROADMAP html.domhash
tracker layer
tracker.ga
Type: keyword
Description: Google Analytics tracker.
Compatibility: datascan app.http.tracker.ga field.
tracker.gaw
Type: keyword
Description: Google Analytics tracker.
Compatibility: datascan app.http.tracker.gaw field.
tracker.gtm
Type: keyword
Description: Google Tag Manager tracker.
Compatibility: datascan app.http.tracker.gtm field.
tracker.gpub
Type: keyword
Description: Google Pub tracker.
Compatibility: datascan app.http.tracker.gpub field.
tracker.fbq
Type: keyword
Description: Meta Pixel tracker.
Compatibility: datascan app.http.tracker.fbq field.
tracker.snaptr
Type: keyword
Description: SNAP tracker.
Compatibility: datascan app.http.tracker.snaptr field.
tracker.newrelic
Type: keyword
Description: NewRelic tracker.
Compatibility: datascan app.http.tracker.newrelic field.
ftp layer
ftp.anonymous
Type: boolean
Description: anonymous access enabled on FTP server (true or false).
Compatibility: datascan app.ftp.anymous field.
favicon layer
favicon.url
Type: keyword
Description: URL of collected favicon.
Compatibility: datascan app.favicon.url field.
favicon.data.base64
Type: keyword
Description: base64 encoding of favicon image. NOTE: cannot be searched, only displayed.
Compatibility: datascan app.favicon.image field.
favicon.data.length
Type: numeric
Description: length of favicon image (favicon.data.base64 length).
Compatibility: datascan app.favicon.length field.
favicon.data.md5
Type: keyword
Description: md5 hash for favicon image, compatible with competitor search engines.
Compatibility: datascan app.favicon.imagemd5 field.
favicon.data.mmh3
Type: numeric
Description: mmh3 hash for favicon image, compatible with competitor search engines.
Compatibility: datascan app.favicon.imagemmh3 field.
hassh layer
hassh.fingerprint.raw
Type: keyword
Description: HASSH fingerprint in raw format.
Compatibility: not applicable.
hassh.fingerprint.md5
Type: keyword
Description: md5 hash for HASSH fingerprint in raw format.
Compatibility: not applicable.
ssh layer
ssh.fingerprint.md5
Type: keyword
Description: md5 hash for SSH fingerprint.
Compatibility: not applicable.
ssh.fingerprint.sha1
Type: keyword
Description: sha1 hash for SSH fingerprint.
Compatibility: not applicable.
ssh.fingerprint.sha256
Type: keyword
Description: sha256 hash for SSH fingerprint.
Compatibility: not applicable.
ROADMAP: ja3s layer
ROADMAP: ja3s.fingerprint.raw
- Type: keyword
ROADMAP: ja3s.fingerprint.md5
- Type: keyword
ROADMAP: ja4s layer
ROADMAP: ja4s.fingerprint.raw
- Type: keyword
ROADMAP: ja4s.fingerprint.md5
- Type: keyword
ROADMAP: jarm layer
ROADMAP: jarm.fingerprint.raw
- Type: keyword
ROADMAP: jarm.fingerprint.md5
- Type: keyword
ROADMAP: jarm.hello1.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello1.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello2.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello2.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello3.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello3.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello4.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello4.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello5.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello5.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello6.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello6.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello7.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello7.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello8.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello8.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello9.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello9.ja3s.md5
- Type: keyword
ROADMAP: jarm.hello10.ja3s.raw
- Type: keyword
ROADMAP: jarm.hello10.ja3s.md5
- Type: keyword