topic Re: browser name extraction from user agent in Security

browser name extraction from user agent

super_edition — Wed, 11 Dec 2024 18:13:49 GMT

Hello Everyone,

I am trying to extract the unique browser name along with its count from the list of user agents(attached file) which is printed in user_agent field of splunk logs.

index=my_index "master" user-agent!="-" user-agent!="DIAGNOSTICS" | eval browser=case( searchmatch("*OPR*"),"Opera", searchmatch("*Edg*"),"Edge", searchmatch("*Chrome*Mobile*Safari*"),"Chrome", searchmatch("*firefox*"),"Firefox", searchmatch("*CriOS*safari"),"Safari") | stats count as page_hit by browser

I am sure the result count is incorrect as I am not covering all the combination of browser string from the attached list.

Appreciate if someone can help me on this.

Many Thanks

Re: browser name extraction from user agent

ITWhisperer — Wed, 11 Dec 2024 21:20:59 GMT

Do something like this to find out which events aren't being counted and adjust your matches accordingly

| eval browser=case( searchmatch("*OPR*"),"Opera", searchmatch("*Edg*"),"Edge", searchmatch("*Chrome*Mobile*Safari*"),"Chrome", searchmatch("*firefox*"),"Firefox", searchmatch("*CriOS*safari"),"Safari") | where isnull(browser)

Re: browser name extraction from user agent

PickleRick — Wed, 11 Dec 2024 21:24:08 GMT

There is an awful lot of different UAs and they can introduce themselves in many various ways. It's not standardized in any way. So browser detection is more an art than strict science. And it's even before we take into account that people can spoof their UA strings or even set it to any arbitrary value.

There are sites gathering known UA strings though. Like https://explore.whatismybrowser.com/useragents/parse/?analyse-my-user-agent=yes#parse-useragent

BTW, your search is very ineffective.

Re: browser name extraction from user agent

super_edition — Thu, 12 Dec 2024 05:01:52 GMT

Thanks @PickleRick for your response.

I am looking to get the count of browsers which are commonly used like chrome, firefox, safari, edge and opera