1 ACCEPTED SOLUTION
Accepted Solutions
Okay I have a working solution.
- I created a PHP Page page on a Webserver based on the DeviceDetector project (Install the DeviceDetector project on your own PhP enabled webserver then use copy the file hello.php to the same directory where DeviceDetector.php resides)
- I created a shellscript that sits on my PhP Enabled webserver that queries my broker for UserAgents on Service 80 and then creates a feed based on the values returned.
-Edit the line in the UserAgentInfo.sh to replace user 'admin:netwitness' 'http://192.168.123.249:50103' with an account and broker that is able to get values. I used admin netwitness because I was a bit lazy and because this is just a test system!
The script creates a file called /var/www/html/useragentfeed.csv that can then be read by Security Analytics as a feed. Note in the feed definition file make sure that the callback key you are using is case-insensitive. The attached DeviceDetector.xml file contains a feed definition example.
The solution could be tweaked for your own environment but as a proof of concept I'm happy with it 😃
Here is a Demo of the hello.php webpage. It basically takes the useragent in the Query and then outputs the findings.
The final output will be the Feed file which I have attached.
I added the following meta keys to my concentrators to use the feed:
<!--DeviceDetector Feed -->
<key description="ClientInfo Type" format="Text" level="IndexValues" name="clientinfo.type" defaultAction="Open" valueMax="500000"/>
<key description="ClientInfo Name" format="Text" level="IndexValues" name="clientinfo.name" defaultAction="Open" valueMax="500000"/>
<key description="ClientInfo Short Name" format="Text" level="IndexValues" name="clientinfo.sname" defaultAction="Open" valueMax="500000"/>
<key description="ClientInfo Version" format="Text" level="IndexValues" name="clientinfo.ver" defaultAction="Open" valueMax="500000"/>
<key description="ClientInfo Platform" format="Text" level="IndexValues" name="clientinfo.plat" defaultAction="Open" valueMax="500000"/>
<key description="OS Type" format="Text" level="IndexValues" name="os.type" defaultAction="Open" valueMax="500000"/>
<key description="OS Name" format="Text" level="IndexValues" name="os.name" defaultAction="Open" valueMax="500000"/>
<key description="OS Short Name" format="Text" level="IndexValues" name="os.sname" defaultAction="Open" valueMax="500000"/>
<key description="OS Version" format="Text" level="IndexValues" name="os.ver" defaultAction="Open" valueMax="500000"/>
<key description="OS Platform" format="Text" level="IndexValues" name="os.platform" defaultAction="Open" valueMax="500000"/>
<key description="Brand" format="Text" level="IndexValues" name="brand" defaultAction="Open" valueMax="500000"/>
<key description="Model" format="Text" level="IndexValues" name="model" defaultAction="Open" valueMax="500000"/>
Okay for a Right Click Menu Action. This will work on Client Meta Key.
Go to Administration ->System -> Context Menu Actions and Click on + to create a New Context Menu action with the following.
{
"displayName": "DeviceDetector",
"cssClasses": [
"client"
],
"description": "",
"type": "UAP.common.contextmenu.actions.URLContextAction",
"version": "1",
"modules": [
"investigation"
],
"local": "false",
"groupName": "externalLookupGroup",
"urlFormat": "http://devicedetector.net//index.php?ua={0}",
"disabled": "",
"id": "DeviceDetectorSearch",
"moduleClasses": [
"UAP.investigation.navigate.view.NavigationPanel",
"UAP.investigation.events.view.EventGrid"
],
"openInNewTab": "true",
"order": "21"
}
Now when you have a client that you wish to investigate - right click
