Somobody has solution how I can transformate data from user.agent metakey (Log and Packet) to some like Device, OS, Application via Feed or LUA Parser? I found some FlexParser in RSA Live, but it is not I want. I found some site like Complete List of iOS User-Agent Strings | Enterprise iOS with DB of iPhone/iPad/IPod, but data is old and I can't create suitable Feed.
- I created a PHP Page page on a Webserver based on the DeviceDetector project (Install the DeviceDetector project on your own PhP enabled webserver then use copy the file hello.php to the same directory where DeviceDetector.php resides)
- I created a shellscript that sits on my PhP Enabled webserver that queries my broker for UserAgents on Service 80 and then creates a feed based on the values returned.
-Edit the line in the UserAgentInfo.sh to replace user 'admin:netwitness' 'http://192.168.123.249:50103' with an account and broker that is able to get values. I used admin netwitness because I was a bit lazy and because this is just a test system!
The script creates a file called /var/www/html/useragentfeed.csv that can then be read by Security Analytics as a feed. Note in the feed definition file make sure that the callback key you are using is case-insensitive. The attached DeviceDetector.xml file contains a feed definition example.
The solution could be tweaked for your own environment but as a proof of concept I'm happy with it 😃
Here is a Demo of the hello.php webpage. It basically takes the useragent in the Query and then outputs the findings.
The final output will be the Feed file which I have attached.
I added the following meta keys to my concentrators to use the feed:
I agree with you, for investigation process is simple way, but many customers (top managers) want to have those data on reports and dashboards. From MS IIS user agent strings looks like Apple-iPad2C2/1304.15 or Microsoft+Office/15.0+(Windows+NT+6.1;+Microsoft+Outlook+15.0.4787;+Pro).
If Feed can be use to contains data it is will be simple...