app:tlsfingerprint
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
app:tlsfingerprint [2017/11/28 23:57] – [Using Trisul streaming analytics] veera | app:tlsfingerprint [2017/11/29 15:14] – vivek | ||
---|---|---|---|
Line 39: | Line 39: | ||
- | ===== Analysis of TLS Fingerprints | + | ==== Analysis of TLS Fingerprints ==== |
What are you going to do with these prints. There are a few options | What are you going to do with these prints. There are a few options | ||
Line 53: | Line 53: | ||
===== How the TrisulNSM App works ===== | ===== How the TrisulNSM App works ===== | ||
- | Since we do not yet have many malware fingerprints, | + | The TLS Print app is written in LuaJIT and plugs into the TrisulNSM Scripting Engine. The source code for the App is available |
+ | |||
+ | The app generates | ||
- **Metrics** : The app generates metrics for each TLS-Print it finds. If the print is a known one, it also updates the label. You can do long term trend analysis to see when each print was seen over the past few months. | - **Metrics** : The app generates metrics for each TLS-Print it finds. If the print is a known one, it also updates the label. You can do long term trend analysis to see when each print was seen over the past few months. | ||
Line 93: | Line 95: | ||
When you reveal adjacent vertices in [[https:// | When you reveal adjacent vertices in [[https:// | ||
- | ==== Programatically resolving TLS Prints ==== | + | ===== Programatically resolving TLS Prints |
- | The TrisulNSM TLS-Print | + | This App dumps all fingerprints |
- | + | We invite | |
- | If you can access | + | |
- | + | ||
- | + | ||
- | + | ||
app/tlsfingerprint.txt · Last modified: 2018/03/04 13:27 by veera