Block Brave Borwser

[HilalWani]

Hello,

I have noticed that some of our employees are using a brave browser and can easily open blocked websites like Facebook, crypto, games etc. what's the way to block brave browsers.

Thanks:

[nikoolayy1]

Maybe write an application signature that matches the User-Agent header. you can use as an examples:

Create a Custom Application (paloaltonetworks.com)

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK

My article for referer header but the principle is the same, just find what is the User-agent string for the browser you want to block:

LIVEcommunity - Knowledge sharing: Version 10 no 7 byte limit for sinatures examples for Layer 7 (L7...

Better if you have EDR/Endpoint Protection or Active Directory to block and delete the browser software on the endpoints themselves.

[BPry]

@HilalWani,

Don't use the firewall to do something it wasn't ever designed to do. User-Agent strings are just that, strings, easily modified in any browser to bypass any restriction you put in place. If your employees are already using Brave to bypass filtering you can also ensure that they'll quickly find out you can modify the User-Agent string to whatever they want and bypass your block.

Instead, do as @nikoolayy1 mentioned at the tale end of his post and use something on the endpoint to block installation of Brave outright. If you have utilize Windows and Active Directory you can easily activate AppLocker and block any publisher you want through AppLocker rules and GPO. Intune and other MDMs can do the same, and the vast majority of Antivirus or EDR solutions can do the exact same thing as long as you have something actively installed and managing these endpoints. 

[JGriessmeier]

Hi,

i think the employees use the "Tor Tabs" Feature. see https://brave.com/privacy-features/

So your approach should not to "Block Brave" but Block Tor connections.

Greetings

[HilalWani]

Coudl you please show me how can i block Tor