↳ GitHub sourceAnalytics ruleMedium

Cisco Cloud Security - Empty User Agent Detected

An inconsistency was detected in the sources: variants or an invalid file. Check the files and commit shown below.

Description

'Rule helps to detect empty and unusual user agent indicating web browsing activity by an unusual process other than a web browser.'

Rule type: Scheduled
Version: 1.1.3
Declared status: Available
Query frequency: 15m
Query period: 15m
Trigger: gt 0

Declared MITRE coverage

CommandAndControl T1001.003

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CiscoUmbrellaDataConnector

Data types

Cisco_Umbrella_proxy_CL

KQL query

Original query, unchanged.

Cisco_Umbrella
| where EventType == "proxylogs"
| where HttpUserAgentOriginal == ''
| extend Message = "Empty User Agent"
| project TimeGenerated, Message, SrcIpAddr, DstIpAddr, UrlOriginal

Declared entities

URLIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaEmptyUserAgentDetected.yaml ↗
Commit: 9800e51 ↗
Source identifier: 2b328487-162d-4034-b472-59f1d53684a1

Additional source files 2

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaEmptyUserAgentDetected.yamlsource ↗Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.