IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Web Application Suspicious Activity: No User Agentedit
A request to a web application server contained no identifying user agent string.
Rule indices:
- apm-*-transaction*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-6m (Date Math format, see also Additional look-back time)
Maximum signals per execution: 100
References:
Tags:
- Elastic
- APM
Rule version: 1
Added (Elastic Stack release): 7.6.0
Potential false positivesedit
Some normal applications and scripts may contain no user agent. Most legitimate web requests from the Internet contain a user agent string. Requests from web browsers almost always contain a user agent string. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity.
Rule queryedit
url.path: *
Rule filtersedit
{
"$state": {
"store": "appState"
},
"exists": {
"field": "user_agent.original"
},
"meta": {
"disabled": false,
"indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
"key": "user_agent.original",
"negate": true,
"type": "exists",
"value": "exists"
}
}