NetWitness has added support for the JA4 entity for UEBA from the 12.5 version or later. This change is implemented because JA4 is identified as the most reliable and improved client identification method. JA4 leverages TLS Client Hello packets to identify application-specific traffic patterns and create unique fingerprints for each application. This reduces the total number of unique fingerprints for modern browsers. As a result, a single client will have only one JA4 fingerprint instead of multiple ones, making it easier to track and monitor.