20230711.6

What’s New!

JARM Fingerprint

The JARM fingerprint is a hash value representing the TLS configuration of a server. Infrastructure run by the same operator tends to have the same JARM value, which helps threat investigators identify malicious and benign infrastructure, facilitating their investigations. The JARM enhancements in this release support investigations by:

• Hyperlinking the JARM value, which appears in the Host Posture tab for IP objects

• Defining a new JARM object page to aggregate IPs that contain the same JARM, and a breakdown of the services running on the host

• Searching for JARMs as independent objects

Adding JARM pivots to Insight arms the investigator with a powerful new method for identifying and understanding malicious infrastructure. This data type complements other data types and pivots in HYAS Insight and brings new context to adversary infrastructure investigations in the product.