[Bro-Dev] [JIRA] (BIT-1104) Add tracking for MSIE 11

Michael Stone (JIRA) jira at bro-tracker.atlassian.net
Thu Dec 5 05:51:45 PST 2013

Michael Stone created BIT-1104:

             Summary: Add tracking for MSIE 11
                 Key: BIT-1104
                 URL: https://bro-tracker.atlassian.net/browse/BIT-1104
             Project: Bro Issue Tracker
          Issue Type: Patch
          Components: Bro
    Affects Versions: 2.1
         Environment: Ubuntu
            Reporter: Michael Stone

MSIE 11.0 currently shows up as <unknown browser>.  It looks like MS might have changed it's user agent string and doesn't include "MSIE".  I added the following to /usr/local/bro/share/bro/base/frameworks/software/main.bro
just below the "MSIE" block and above the "Safari" block.

else if ( /Trident\/7.0/ in uparsed_version ) 
   if ( /rv:11\.0/ in unparsed_version ) {
       software_name = "MSIE";
       v = [$major=11,$minor=0];

Disclaimer: I'm fairly new to working with Bro so this might not be the best way, but it seems to be working for me.

This message was sent by Atlassian JIRA

More information about the bro-dev mailing list