{"id":1790,"date":"2025-04-16T15:27:08","date_gmt":"2025-04-16T13:27:08","guid":{"rendered":"https:\/\/www.sycope.com\/post\/how-to-monitor-encrypted-traffic-in-sycope"},"modified":"2025-06-27T14:46:04","modified_gmt":"2025-06-27T12:46:04","slug":"jak-w-sycope-monitorowac-zaszyfrowany-ruch","status":"publish","type":"post","link":"https:\/\/www.sycope.com\/pl\/post\/jak-w-sycope-monitorowac-zaszyfrowany-ruch","title":{"rendered":"Jak w Sycope monitorowa\u0107 zaszyfrowany ruch?"},"content":{"rendered":"<p data-start=\"457\" data-end=\"927\">Wska\u017aniki te mog\u0105 obejmowa\u0107 adresy IP, nazwy host\u00f3w, adresy URL, hashe plik\u00f3w, geolokalizacje (ASN-y, kraje), konta e-mail, agenty u\u017cytkownika i wiele innych. W\u015br\u00f3d powszechnie wykorzystywanych wska\u017anik\u00f3w szczeg\u00f3ln\u0105 uwag\u0119 warto zwr\u00f3ci\u0107 na odcisk palca JA3 TLS. JA3 to narz\u0119dzie do tworzenia odcisk\u00f3w palca po\u0142\u0105cze\u0144 TLS na podstawie opcji negocjowanych podczas sesji TLS. Na podstawie tych odcisk\u00f3w mo\u017cna wykrywa\u0107 konkretne aplikacje, jak r\u00f3wnie\u017c z\u0142o\u015bliwe oprogramowanie.<\/p>\n<p data-start=\"929\" data-end=\"1290\">Ta metoda jest szczeg\u00f3lnie przydatna, poniewa\u017c wi\u0119kszo\u015b\u0107 ruchu w organizacjach jest zazwyczaj szyfrowana, co oznacza, \u017ce systemy analizy pakiet\u00f3w sieciowych, takie jak IPS, s\u0105 silnie ograniczone bez odszyfrowywania ruchu. W internecie mo\u017cna znale\u017a\u0107 wiele wska\u017anik\u00f3w kompromitacji zawieraj\u0105cych z\u0142o\u015bliwe odciski JA3, np. <a class=\"\" href=\"https:\/\/sslbl.abuse.ch\/ja3-fingerprints\/\" target=\"_new\" rel=\"noopener\" data-start=\"1249\" data-end=\"1289\">https:\/\/sslbl.abuse.ch\/ja3-fingerprints\/<\/a>.<\/p>\n<p>Odciski JA3 s\u0105 dost\u0119pne dla klient\u00f3w, kt\u00f3rzy zakupili licencj\u0119 Performance systemu Sycope NSM.<\/p>\n<figure id=\"attachment_1013\" aria-describedby=\"caption-attachment-1013\" style=\"width: 757px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1013\" src=\"https:\/\/sycope.com\/wp-content\/uploads\/2025\/04\/6449638e5f2b7e5a40301f7f_security-SOC-ja3.png\" alt=\"\" width=\"757\" height=\"311\" srcset=\"https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/6449638e5f2b7e5a40301f7f_security-SOC-ja3.png 1242w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/6449638e5f2b7e5a40301f7f_security-SOC-ja3-300x123.png 300w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/6449638e5f2b7e5a40301f7f_security-SOC-ja3-1024x420.png 1024w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/6449638e5f2b7e5a40301f7f_security-SOC-ja3-768x315.png 768w\" sizes=\"auto, (max-width: 757px) 100vw, 757px\" \/><figcaption id=\"caption-attachment-1013\" class=\"wp-caption-text\"><strong data-start=\"1388\" data-end=\"1402\">Ekran 1.<\/strong> Przyk\u0142ad wzbogacenia danych NetFlow o odciski JA3<\/figcaption><\/figure>\n<p>W Sycope NSM dost\u0119pna jest wbudowana regu\u0142a do wykrywania z\u0142o\u015bliwych odcisk\u00f3w JA3, jednak poni\u017cej znajduje si\u0119 przyk\u0142ad prostego zapytania do wykrywania tej aktywno\u015bci.<\/p>\n<figure id=\"attachment_1014\" aria-describedby=\"caption-attachment-1014\" style=\"width: 757px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1014\" src=\"https:\/\/sycope.com\/wp-content\/uploads\/2025\/04\/6449640661ead97f1ae2216a_ja4.png\" alt=\"\" width=\"757\" height=\"35\" srcset=\"https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/6449640661ead97f1ae2216a_ja4.png 1242w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/6449640661ead97f1ae2216a_ja4-300x14.png 300w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/6449640661ead97f1ae2216a_ja4-1024x48.png 1024w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/6449640661ead97f1ae2216a_ja4-768x36.png 768w\" sizes=\"auto, (max-width: 757px) 100vw, 757px\" \/><figcaption id=\"caption-attachment-1014\" class=\"wp-caption-text\"><strong data-start=\"1624\" data-end=\"1638\">Ekran 2.<\/strong> Przyk\u0142ad zapytania do wykrywania z\u0142o\u015bliwego ruchu na podstawie odcisk\u00f3w JA3<\/figcaption><\/figure>\n<figure id=\"attachment_1015\" aria-describedby=\"caption-attachment-1015\" style=\"width: 757px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1015\" src=\"https:\/\/sycope.com\/wp-content\/uploads\/2025\/04\/644964a7b0a178e0973b95d7_soc-cybersecurity.png\" alt=\"\" width=\"757\" height=\"564\" srcset=\"https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/644964a7b0a178e0973b95d7_soc-cybersecurity.png 1137w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/644964a7b0a178e0973b95d7_soc-cybersecurity-300x223.png 300w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/644964a7b0a178e0973b95d7_soc-cybersecurity-1024x763.png 1024w, https:\/\/www.sycope.com\/wp-content\/uploads\/2025\/04\/644964a7b0a178e0973b95d7_soc-cybersecurity-768x572.png 768w\" sizes=\"auto, (max-width: 757px) 100vw, 757px\" \/><figcaption id=\"caption-attachment-1015\" class=\"wp-caption-text\"><strong data-start=\"1716\" data-end=\"1730\">Ekran 3.<\/strong> Przyk\u0142ad lookupu ze z\u0142o\u015bliwymi odciskami JA3<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Wska\u017aniki te mog\u0105 obejmowa\u0107 adresy IP, nazwy host\u00f3w, adresy URL, hashe plik\u00f3w, geolokalizacje (ASN-y, kraje), konta e-mail, agenty u\u017cytkownika i wiele innych. W\u015br\u00f3d powszechnie wykorzystywanych wska\u017anik\u00f3w szczeg\u00f3ln\u0105 uwag\u0119 warto zwr\u00f3ci\u0107 na odcisk palca JA3 TLS. JA3 to narz\u0119dzie do tworzenia odcisk\u00f3w palca po\u0142\u0105cze\u0144 TLS na podstawie opcji negocjowanych podczas sesji TLS. Na podstawie tych odcisk\u00f3w [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1396,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[99],"tags":[114,115,130],"product":[164,165,166],"topic":[167,168],"sycope_author":[251],"class_list":["post-1790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-analizy-netflow","tag-skanowanie-sieci","tag-wykrywanie-zagrozen","product-performance-pl","product-security-pl","product-visibility-pl","topic-bezpieczenstwo-sieci","topic-monitorowanie-i-analiza-sieci","sycope_author-pawel-drzewiecki"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/1790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/comments?post=1790"}],"version-history":[{"count":4,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/1790\/revisions"}],"predecessor-version":[{"id":2133,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/1790\/revisions\/2133"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/media\/1396"}],"wp:attachment":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/media?parent=1790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/categories?post=1790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/tags?post=1790"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/product?post=1790"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/topic?post=1790"},{"taxonomy":"sycope_author","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/sycope_author?post=1790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}