Custom App for third party Browsers

[paloasaf]

I'm trying to create a custom app that identifies browsers as a matter of fact - i need to identify all browsers that do not have MSIE in their http-request .

i tried different regexp patterns and none of them seem to work

[^[MSIE]] - less than 7 chars

[^[MSIE [0-9]\.[0-9]]] - still less than 7 chars? (hmm 4 + 3)

User-Agent [^[MSIE]] - does not seems to work   tested browsing  on my computer with safari - PA detects it as web-browsing.

[paloasaf]

i'm sorry. i ment

[^(MSIE)] -

[^(MSIE [0-9]\.[0-9])] -

User-Agent [^(MSIE)] -

[mharding]

I would start from here. It's the same principle.

.*(User-Agent:) .* (Nmap Scripting Engine)

[paloasaf]

the main problem is that i need to negate something.

of course i could create 10+ custom apps for each browser, but i think this i not the correct way - what happens if tomorrow somebody will create a new one?

and somthing else:

regex:

.*(User-Agent).*(Chrome)

is a bad idea - some cites write data for different borwsers, so that it is posiible that in http-req will appear word opera.

[mharding]

I would set it up as a threat opposed to an app.

https://live.paloaltonetworks.com/docs/DOC-1503

[paloasaf]

as i already said - it's a bad practice to create custom apps for all the browser, it is much more  better to create a negating rule