Greetings. JA3 support for osquery has been available to Uptycs customers for awhile now through a

http_events

table. Although submitted, this table has not been merged with the core osquery, but the patch is now publicly available for those looking to add it to their own osquery builds. Learn more and find the diff here: https://www.uptycs.com/blog/osquery-and-ja3-detecting-malicious-encrypted-connections-locally