Ja4+ and Zeek Parsing

[ColeVan]

Hello everyone!

I'm looking to incorporate ja4+ fingerprinting and need a little advice on how to parse those specific fields. What would be the best way to extract ja4 fields from message much like how ja3 is being parsed as hash.ja3? Thanks in advance!

[ColeVan]

After reviewing the zeek.ssl pipeline configuration I was able to figure out how to parse ja4 and ja4s from the message field. I'm using zeek ja4 configurations from this github link below if anyone else is interested.
https://github.com/FoxIO-LLC/ja4/tree/main/zeek

[reyesj2]

Noticed there wasn't an issue to keep this from being lost. Created #14465 to investigate including this into a future release.