RegEx looking for a specific UserAgent.

[scantwell]

I tried to migrate over my Cisco IPS regex to Palo Alto but it failed to load. Below is my Cisco Regex.

[Uu][Ss][Ee][Rr][-][Aa][Gg][Ee][Nn][Tt][:][\x20][^\x0d\x0a]*([Ss][Yy][Nn][Aa][Pp][Ss][Ee])

I tried creating a new pattern but it is to specific and not working.

I am looking to search the http header for User-Agent and if the value contains the word Synapse then alert.

Can someone help me to better understand what I am doing wrong?

Can someone educate me AND help generate the RegEx example for me.. (that is my real question)

Thanks

Steve

[HITSSEC]

Steve,

The following works for XP detection:

So I would guess the pattern could be: User-Agent:.Synapse

One way to perfect it is to get a packet capture.  You may want to start with a pattern of just Synapse  and once you get a packet capture you can tune it up.

Phil

[Mariusz.pianka]

Thank You Phil,

Using your string and manipulating it a little bit, I was able to adapt it to my needs.

Much appreciated.