This will add JA4+ fingerprints to respective protocol zeek logs.
JA4SSH will output to it's own log.

JA4 → ssl.log
JA4S → ssl.log
JA4H → http.log
JA4L → conn.log
JA4LS → conn.log
JA4T → conn.log
JA4TS → conn.log
JA4SSH → ja4ssh.log
JA4X → x509.log (still in development)

See https://github.com/FoxIO-LLC/ja4 for more detail on JA4+ and implementations into other open source tools.

Run the following command on your Zeek nodes:

zkg install zeek/foxio/ja4

If you don't have the zeek package manager, copy this directory to zeek/share/zeek/site/ja4plus and add this line to either load.zeek or local.zeek in zeek/share/zeek/site/:

@load ja4plus

Zeek 5+ is supported.
Zeek 6+ is required for QUIC support.

Individual JA4+ methods can be enabled or disabled in config.zeek.
The raw output for JA4+ methods (non-hashed) can also be enabled in config.zeek

See License FAQ for details.