Include Zeek scripts for JA3/JA3s and HASSH about zeek HOT 3 CLOSED

Implementation note: Just to prove to myself that this would be pretty trivial, using an npm install'd local Dev checkout of Brim in my ~work/brim, I was able to get JA3/HASSH data included in my generated logs with these simple steps:

~/work$ git clone https://github.com/salesforce/ja3.git
~/work$ git clone https://github.com/salesforce/hassh.git
~/work$ cd ~/work/brim
~/work/brim$ mv ~/work/ja3/zeek zdeps/zeek/share/zeek/site/ja3
~/work/brim$ mv ~/work/hassh/bro zdeps/zeek/share/zeek/site/hassh
~/work/brim$ echo "@load ./ja3" >> zdeps/zeek/share/zeek/site/local.zeek
~/work/brim$ echo "@load ./hassh" >> zdeps/zeek/share/zeek/site/local.zeek

from zeek.

I've put up a PR at salesforce/hassh#10 to try and get HASSH de-Bro'ed before we include it in Brim. I also pinged Ben Reardon on Slack to see if he could help push it through with his contacts back at Salesforce.

from zeek.

Verified in Brim commit e079837.

To verify, I made release artifacts on macOS, Windows, and Linux at that commit and imported pcaps to confirm the generated Zeek data now has the JA3/HASSH fields on ssl and ssh events, respectively.

On macOS:

On Linux:

On Windows:

Thanks @nwt!

from zeek.