↳ GitHub sourceAnalytics ruleMedium
Cisco Umbrella - Empty User Agent Detected
An inconsistency was detected in the sources: variants or an invalid file. Check the files and commit shown below.
Description
'Rule helps to detect empty and unusual user agent indicating web browsing activity by an unusual process other than a web browser.'
- Rule type
- Scheduled
- Version
- 1.1.2
- Query frequency
- 15m
- Query period
- 15m
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
let timeframe = 15m;
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal == ''
| extend Message = "Empty User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
2b328487-162d-4034-b472-59f1d53684a1
Additional source files 1
Detections/CiscoUmbrella/CiscoUmbrellaEmptyUserAgentDetected.yamlsource ↗GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC