bro_x509.yml

name: Bro x509
id: e8792367-64b0-47e9-b923-6764b0f7e936
version: 2
date: '2025-01-23'
author: Jacob Delgado, SnapAttack
description: Logs details about X.509 certificates observed in network traffic captured
  by Zeek (formerly Bro), including certificate fields, validity periods, and issuers.
mitre_components:
- Certificate Registration
- Network Traffic Content
- Response Metadata
- Application Log Content
- Host Status
source: bro:x509:json
sourcetype: bro:x509:json
supported_TA:
- name: TA for Zeek
  url: https://splunkbase.splunk.com/app/5466
  version: 1.0.8