My zeek sensor is seeing self-signed certs on my smartthings traffic. Anyone else seeing this?
conn.log:{“ts”:“2021-01-27T19:24:41.578940Z”,“uid”:“CqDlJ13km4OcQKI9ji”,“id.orig_h”:“192.168.x.y”,“id.orig_p”:53350,“id.resp_h”:“34.200.5.134”,“id.resp_p”:443,“proto”:“tcp”,“duration”:0.22186017036437988,“orig_bytes”:1256,“resp_bytes”:2085,“conn_state”:“SF”,“local_orig”:true,“local_resp”:false,“missed_bytes”:0,“history”:“ShADadFRf”,“orig_pkts”:16,“orig_ip_bytes”:2072,“resp_pkts”:16,“resp_ip_bytes”:2925,“orig_l2_addr”:“d0:52:a8:53:ff:45”,“resp_l2_addr”:“3c:37:86:fe:16:d2”}
files.log:{“ts”:“2021-01-27T19:24:41.636325Z”,“fuid”:“FnlLnW2SZeNRHFhaA3”,“tx_hosts”:[“34.200.5.134”],“rx_hosts”:[“192.168.x.y”],“conn_uids”:[“CqDlJ13km4OcQKI9ji”],“source”:“SSL”,“depth”:0,“analyzers”:[“SHA1”,“MD5”,“X509”],“mime_type”:“application/x-x509-user-cert”,“duration”:0.0,“local_orig”:false,“is_orig”:false,“seen_bytes”:777,“missing_bytes”:0,“overflow_bytes”:0,“timedout”:false,“md5”:“f0d7a4644fca32b4d8ca680d0b2c3b57”,“sha1”:“7ed3470e599e0dc27a79460c3ebb3e8c6fcd9246”}
files.log:{“ts”:“2021-01-27T19:24:41.636325Z”,“fuid”:“FEymcp3WAF4Vhlbh7i”,“tx_hosts”:[“34.200.5.134”],“rx_hosts”:[“192.168.x.y”],“conn_uids”:[“CqDlJ13km4OcQKI9ji”],“source”:“SSL”,“depth”:0,“analyzers”:[“SHA1”,“MD5”,“X509”],“mime_type”:“application/x-x509-ca-cert”,“duration”:0.0,“local_orig”:false,“is_orig”:false,“seen_bytes”:563,“missing_bytes”:0,“overflow_bytes”:0,“timedout”:false,“md5”:“1c38030b3b95aec3ab75f32c57953a82”,“sha1”:“72a94e135395ec7f63417c1d19da421455b1aa30”}
notice.log:{“ts”:“2021-01-27T19:24:41.667339Z”,“uid”:“CqDlJ13km4OcQKI9ji”,“id.orig_h”:“192.168.x.y”,“id.orig_p”:53350,“id.resp_h”:“34.200.5.134”,“id.resp_p”:443,“fuid”:“FnlLnW2SZeNRHFhaA3”,“proto”:“tcp”,“note”:“SSL::Invalid_Server_Cert”,“msg”:“SSL certificate validation failed with (self signed certificate in certificate chain)”,“sub”:“CN=STFWSRV,OU=SmartThings,O=SmartThings,ST=Minnesota,C=US”,“src”:“192.168.x.y”,“dst”:“34.200.5.134”,“p”:443,“peer_descr”:“worker-1”,“actions”:[“Notice::ACTION_LOG”],“suppress_for”:3600.0}
ssl.log:{“ts”:“2021-01-27T19:24:41.607328Z”,“uid”:“CqDlJ13km4OcQKI9ji”,“id.orig_h”:“192.168.x.y”,“id.orig_p”:53350,“id.resp_h”:“34.200.5.134”,“id.resp_p”:443,“version”:“TLSv12”,“cipher”:“TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256”,“curve”:“secp256r1”,“resumed”:false,“established”:true,“cert_chain_fuids”:[“FnlLnW2SZeNRHFhaA3”,“FEymcp3WAF4Vhlbh7i”],“client_cert_chain_fuids”:,“subject”:“CN=STFWSRV,OU=SmartThings,O=SmartThings,ST=Minnesota,C=US”,“issuer”:“CN=STCA,OU=SmartThings,O=SmartThings,ST=Minnesota,C=US”,“validation_status”:“self signed certificate in certificate chain”}