WhatsMyBrowser

Parse user agents and determine if they are malicious as well as enrich information about the agent.

Data Enrichment & Threat Intelligence · WhatIsMyBrowser

Details

ID	`WhatsMyBrowser`
Provider	WhatIsMyBrowserLimited
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10325753`
Supported Modules	Agentix XSIAM

README

WhatIsMyBrowser parses user agent strings and gives insight into known user agents. For example, if the user agent string is malicious, WhatIsMyBrowser will indicate that the user agent is known to be malicious.

Configure WhatIsMyBrowser on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for WhatsMyBrowser.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- API Key: your API key
- Use system proxy settings:
- Trust any certificate (insecure)
- URL for WhatIsMyBrowser: The URL endpoint for the WhatIsMyBrowser
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Parse a User Agent string: ua-parse

1. Parse a User Agent string

Parses a User Agent string.

Base Command

ua-parse

Input

Argument Name	Description	Required
UserAgent	User Agent string	Required

Context Output

Path	Type	Description
UA.Parse.Software	string	Software extracted from UA string.
UA.Parse.SoftwareName	string	Software Name extracted from UA string.
UA.Parse.OperatingSystem	string	Operating System extracted from UA string.
UA.Parse.Abusive	boolean	Whether or not the UA has been identified as abusive.
UA.Parse.OperatingSystemName	string	Operating System Name extracted from UA string.
UA.Parse.UserAgent	string	User agent string.
UA.Parse.HardwareType	string	Hardware Type as extracted from UA string.
UA.Parse.HardwareSubType	string	Hardware Sub Type as extracted from UA string.

Command Example

!ua-parse UserAgent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36"

Context Example

{
    "DBotScore": {
        "Vendor": "WhatIsMyBrowser",
        "Indicator": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36",
        "Score": 1,
        "Type": "UserAgent"
    },
    "UA": {
        "Parse": {
            "Abusive": false,
            "HardwareType": "computer",
            "SoftwareName": "Chrome",
            "OperatingSystemName": "macOS",
            "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36",
            "OperatingSystem": "macOS (Mojave)",
            "Software": "Chrome 72"
        }
    }
}

Human Readable Output

Configuration parameters

url — URL for WhatIsMyBrowser (required)
api_key — API Key
credentials_api_key —
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (1)

ua-parse
Parses a User Agent string.

Source

WhatIsMyBrowser.py WhatIsMyBrowser.yml WhatIsMyBrowser_description.md

Download History Raw

commonfields:
  id: WhatsMyBrowser
  version: -1
name: WhatsMyBrowser
sectionorder:
- Connect
- Collect
display: WhatIsMyBrowser
category: Data Enrichment & Threat Intelligence
provider: WhatIsMyBrowserLimited
description: Parse user agents and determine if they are malicious as well as enrich information about the agent.
configuration:
- display: URL for WhatIsMyBrowser
  name: url
  defaultvalue: https://api.whatismybrowser.com/api/v2/user_agent_parse # disable-secrets-detection
  type: 0
  required: true
  section: Connect
- display: API Key
  section: Connect
  name: api_key
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- name: credentials_api_key
  section: Connect
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: false
- display: Use system proxy settings
  section: Connect
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  section: Connect
  type: 8
  required: false
script:
  script: ''
  type: python
  commands:
  - name: ua-parse
    arguments:
    - name: UserAgent
      required: true
      description: User Agent String.
    outputs:
    - contextPath: UA.Parse.Software
      description: Software extracted from UA string.
      type: string
    - contextPath: UA.Parse.SoftwareName
      description: Software Name extracted from UA string.
      type: string
    - contextPath: UA.Parse.OperatingSystem
      description: Operating System extracted from UA string.
      type: string
    - contextPath: UA.Parse.Abusive
      description: Whether or not the UA has been identified as abusive.
      type: boolean
    - contextPath: UA.Parse.OperatingSystemName
      description: Operating System Name extracted from UA string.
      type: string
    - contextPath: UA.Parse.UserAgent
      description: User agent string.
      type: string
    - contextPath: UA.Parse.HardwareType
      description: Hardware Type as extracted from UA string.
      type: string
    - contextPath: UA.Parse.HardwareSubType
      description: Hardware Sub Type as extracted from UA string.
      type: string
    description: Parses a User Agent string.
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10325753
tests:
- WhatsMyBrowser-Test
fromversion: 5.0.0