Skip to content
NETALERT Documentation NETALERT Docs User Documentation
Version 1.3

Documentation

IOC JA4

IOC JA4

A4 is an evolution of JA3 that identifies TLS clients based on characteristics of the Client Hello message exchanged during the TLS handshake. Compared to JA3, JA4 provides more consistent and structured fingerprints, improving the identification and analysis of TLS client behavior.

JA4 sorts cipher suites and TLS extensions before generating their respective hashes, reducing the impact of changes in their ordering. This makes JA4 fingerprints more resilient to variations introduced by client applications and TLS libraries.

A JA4 fingerprint consists of three sections containing information such as the transport protocol, TLS version, Server Name Indication (SNI) presence, number of cipher suites and extensions, Application-Layer Protocol Negotiation (ALPN), and truncated hashes of selected TLS handshake attributes.

This structured format supports easier fingerprint interpretation, comparison, and identification of similarities between TLS clients.

The IOC JA4 page holds the fingerprints NETALERT treats as indicators of compromise. When a connection is observed whose JA4 fingerprint appears in this list, an alert is raised.

Managing IOC JA4 fingerprints

Navigate to Administration > Security & Threat Intelligence > IOC JA4.

The following actions are available:

  • Add IOCJa4 – Manually add a single JA4 fingerprint to be treated as an indicator of compromise.
  • Edit – Modify an existing entry.
  • Delete – Remove a fingerprint from the list.
  • Import CSV – Bulk upload a list of fingerprints, typically one published by a threat intelligence source.
  • Export CSV – Download the current list, for backup or for transfer to another instance.
  • Truncate – Remove every entry in the list. This clears the whole indicator set in one operation and cannot be undone. Export first if the list may be needed again.

Reviewing matches

Fingerprints seen on the network are summarised in the JA4 / TLS Intelligence section of the Security Analytics page. Alerts raised by a match appear in Alerts.

JA3 and JA4 are maintained as separate lists and both remain in use: many published threat intelligence feeds still distribute JA3 values, while JA4 is preferable for new work because of its resistance to ordering-based evasion. Where a feed provides both, populating both lists gives the widest coverage.