topic RegEx looking for a specific UserAgent. in Automation/API Discussions

RegEx looking for a specific UserAgent.

scantwell — Fri, 15 Aug 2014 21:58:42 GMT

I tried to migrate over my Cisco IPS regex to Palo Alto but it failed to load. Below is my Cisco Regex.

[Uu][Ss][Ee][Rr][-][Aa][Gg][Ee][Nn][Tt][:][\x20][^\x0d\x0a]*([Ss][Yy][Nn][Aa][Pp][Ss][Ee])

I tried creating a new pattern but it is to specific and not working.

I am looking to search the http header for User-Agent and if the value contains the word Synapse then alert.

Can someone help me to better understand what I am doing wrong?

Can someone educate me AND help generate the RegEx example for me.. (that is my real question)

Thanks

Steve

Re: RegEx looking for a specific UserAgent.

HITSSEC — Sat, 16 Aug 2014 23:34:18 GMT

Steve,

The following works for XP detection:

So I would guess the pattern could be: User-Agent:.Synapse

One way to perfect it is to get a packet capture. You may want to start with a pattern of just Synapse and once you get a packet capture you can tune it up.

Phil

Re: RegEx looking for a specific UserAgent.

Mariusz.pianka — Sun, 08 Mar 2015 13:41:35 GMT

Thank You Phil,

Using your string and manipulating it a little bit, I was able to adapt it to my needs.

Much appreciated.