WhatsMyBrowser

Parse user agents and determine if they are malicious as well as enrich information about the agent.

Data Enrichment & Threat Intelligence · WhatIsMyBrowser

Details

ID	`WhatsMyBrowser`
Provider	WhatIsMyBrowserLimited
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10325753`
Supported Modules	Agentix XSIAM

README

WhatIsMyBrowser parses user agent strings and gives insight into known user agents. For example, if the user agent string is malicious, WhatIsMyBrowser will indicate that the user agent is known to be malicious.

Configure WhatIsMyBrowser on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for WhatsMyBrowser.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- API Key: your API key
- Use system proxy settings:
- Trust any certificate (insecure)
- URL for WhatIsMyBrowser: The URL endpoint for the WhatIsMyBrowser
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Parse a User Agent string: ua-parse

1. Parse a User Agent string

Parses a User Agent string.

Base Command

ua-parse

Input

Argument Name	Description	Required
UserAgent	User Agent string	Required

Context Output

Path	Type	Description
UA.Parse.Software	string	Software extracted from UA string.
UA.Parse.SoftwareName	string	Software Name extracted from UA string.
UA.Parse.OperatingSystem	string	Operating System extracted from UA string.
UA.Parse.Abusive	boolean	Whether or not the UA has been identified as abusive.
UA.Parse.OperatingSystemName	string	Operating System Name extracted from UA string.
UA.Parse.UserAgent	string	User agent string.
UA.Parse.HardwareType	string	Hardware Type as extracted from UA string.
UA.Parse.HardwareSubType	string	Hardware Sub Type as extracted from UA string.

Command Example

!ua-parse UserAgent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36"

Context Example

{
    "DBotScore": {
        "Vendor": "WhatIsMyBrowser",
        "Indicator": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36",
        "Score": 1,
        "Type": "UserAgent"
    },
    "UA": {
        "Parse": {
            "Abusive": false,
            "HardwareType": "computer",
            "SoftwareName": "Chrome",
            "OperatingSystemName": "macOS",
            "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36",
            "OperatingSystem": "macOS (Mojave)",
            "Software": "Chrome 72"
        }
    }
}

Human Readable Output

Configuration parameters

url — URL for WhatIsMyBrowser (required)
api_key — API Key
credentials_api_key —
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (1)

ua-parse
Parses a User Agent string.

Source

WhatIsMyBrowser.py WhatIsMyBrowser.yml WhatIsMyBrowser_description.md

Download History Raw

The User Agent Parse API from WhatIsMyBrowser allows you to send a User Agent String and received a detailed response back, describing as much as possible about the string. The `ua-parse` command is designed for parsing individual user agents.