stage(research): complete — research brief + findings

[craig-dt]

Stage 1 of the pipeline. Docs only — no code.

Delivers docs/research-brief.md (the approved gate) and docs/research.md (findings against it), and advances current_stage to prd.

Three findings that change the design as briefed

1. Suricata over Snort 3. Decided on your stated tiebreaker — volume of high-confidence free rulesets. Suricata has ~30 centrally-indexed free sources with a declared licence each (OISF/suricata-intel-index), and ET's per-rule confidence metadata gives a machine-checkable Tier 2 admission filter. Snort's counter-argument is recorded: Talos LightSPD is curated by paid researchers while ET Open is community-produced.

2. Replay only for PANW. Zeek and Suricata read a pcap natively; only PANW VM-Series has no offline ingest. The brief sent everything through replay. Since replay is the largest threat to label fidelity — and a dropped packet is an invisible missing label — keeping Tier 2/3 offline makes them deterministic and reproducible, and confines the risk to the one source that can't avoid it.

3. JA4 as enrichment, not a label. This contradicts the brief and is the most significant finding:

• abuse.ch SSLBL's JA3 list has its newest entry dated 2021-08-03 and warns its fingerprints are "not been tested against known good traffic yet and may cause a significant amount of FPs". The file regenerates every 5 minutes, so mtime-based freshness checks would call it healthy.
• JA3 is collision-prone and destabilised by Chrome/Firefox ClientHello shuffling. For training data the costly failure is a collision mislabelling benign traffic.
• No free trustworthy JA4 malicious-verdict feed exists, and no threat name is derivable from a fingerprint match.
• Licence flag: JA4+ (JA4S/JA4H/JA4X/…) is FoxIO License 1.1, non-commercial only. Plain JA4 is BSD 3-Clause. Recommend restricting to plain JA4.

Also surfaced

• pcap ingest normalization is a real work item. Zeek cannot read pcapng at all; Suricata only partially, breaking on multi-datalink files. Since pcapng is Wireshark's default, "all commonly supported formats" needs a detect/convert/split stage with the conversion recorded in provenance.
• Positive Technologies rule sources excluded — non-standard licence (noted per your guidance) and the vendor has been under US sanctions since 2021. Flagged as your call.
• No government body publishes a maintained ruleset. Stated plainly rather than padding the list.

Open items

4 decisions needed from you and 5 open questions are listed at the end of docs/research.md — chiefly the JA4 enrichment-vs-label ruling, the PT sanctions call, whether JA4+ needs legal review, and whether the lab is a v1 prerequisite.

Closes #1

🤖 Generated with Claude Code

[craig-dt]

Review notes resolved — all 24 inline notes actioned; braces stripped and decisions folded into docs/research.md.

Two corrections to my own findings

The admission filter had a real bug, which your "what is the impact to the other sets?" note exposed. The global rule confidence == High AND severity in (Major, Critical) would have excluded 100% of the IOC feeds — abuse.ch, malsilo, pawpatrules carry no ET confidence taxonomy, so the condition is false for every rule in them. As written it admitted ET Open and silently deleted everything else. Now a per-source policy: metadata filter for signature rulesets, wholesale admission plus snapshot provenance for IOC feeds, where FP risk lives in the indicator list rather than the rule logic.

"Drop JA3" is reversed, with your agreement. ET Open maintains its own emerging-ja3.rules — created_at dates through 2026_03_13, confidence and signature_severity metadata on every rule, MIT-licensed, ~100+ rules targeting malware C2 (Cobalt Strike, Remcos, Trickbot). Having found abuse.ch SSLBL frozen at 2021, I generalised to "no trustworthy free JA3 source" — wrong. Only the abandoned SSLBL source is dropped.

Also narrowed: the ClientHello-shuffling critique degrades JA3 for browser identification, but these rules fingerprint malware TLS stacks, which are typically fixed. And clarified that ">70% metadata coverage" is not "70% admitted" — coverage means the tag exists; admission also requires High and Major/Critical.

Your Tier 2 framing was right at the mechanism level

Suricata matches fingerprints natively via the ja3.hash / ja4.hash rule keywords, so encrypted detection is Tier 2 rule content — no separate engine, no separate feed pipeline, and it inherits the same filter, snapshot provenance, and tiering as every other rule. JA4 stays enrichment only because ET ships no ja4 rules yet; it promotes into Tier 2 with zero architectural change the day they do.

Also added

• Pricing: ET Pro ~$900/sensor/year list, ~$750 via the OPNsense reseller. Secureworks scwx/* and Stamus nrd-* publish nothing — quote-only.
• Aging answer: a JA3/JA4 hash is deterministic and never reassigned, so aging isn't expiry — it's the population of software sharing a fingerprint changing. Malware rotating its TLS library yields false negatives (inert entries); benign software adopting a fingerprint yields false positives (the dangerous case). Sourcing verdicts through ET rules puts that maintenance burden on ET.
• Issues Research: should untagged ET Open rules be admitted? #10 (untagged ET rules) and Measure Tier 2 admission-filter impact per source #11 (admission-filter measurement) filed for the deferred items.

Open questions are down from 5 to 5 — but they're different ones, all narrower and mostly empirical.