From 38cc6f595fbea20b5f70a42cc7500492eb19d3b7 Mon Sep 17 00:00:00 2001
From: Mats Klepsland <mats.klepsland@gmail.com>
Date: Sun, 10 Dec 2017 16:40:58 +0100
Subject: [PATCH] doc: add documentation for ja3_hash keyword

---
 doc/userguide/rules/index.rst        |  1 +
 doc/userguide/rules/ja3-keywords.rst | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 doc/userguide/rules/ja3-keywords.rst

diff --git a/doc/userguide/rules/index.rst b/doc/userguide/rules/index.rst
index d7543ec288..55f6e8aa1c 100644
--- a/doc/userguide/rules/index.rst
+++ b/doc/userguide/rules/index.rst
@@ -13,6 +13,7 @@ Suricata Rules
    file-keywords
    dns-keywords
    tls-keywords
+   ja3-keywords
    modbus-keyword
    dnp3-keywords
    enip-keyword
diff --git a/doc/userguide/rules/ja3-keywords.rst b/doc/userguide/rules/ja3-keywords.rst
new file mode 100644
index 0000000000..35676a9263
--- /dev/null
+++ b/doc/userguide/rules/ja3-keywords.rst
@@ -0,0 +1,21 @@
+JA3 Keywords
+============
+
+Suricata comes with a JA3 integration (https://github.com/salesforce/ja3). JA3 is used to fingerprint TLS clients.
+
+JA3 must be enabled in the Suricata config file (set 'app-layer.protocols.tls.ja3-fingerprints' to 'yes').
+
+ja3_hash
+--------
+
+Match on JA3 hash (md5).
+
+Example::
+
+  alert tls any any -> any any (msg:"match JA3 hash"; \
+      ja3_hash; content:"e7eca2baf4458d095b7f45da28c16c34"; \
+      sid:100001;)
+
+``ja3_hash`` is a 'Sticky buffer'.
+
+``ja3_hash`` can be used as ``fast_pattern``.