[Bro-Dev] [JIRA] (BIT-1104) Add tracking for MSIE 11

[Michael Stone (JIRA)]

Michael Stone created BIT-1104:
----------------------------------

             Summary: Add tracking for MSIE 11
                 Key: BIT-1104
                 URL: https://bro-tracker.atlassian.net/browse/BIT-1104
             Project: Bro Issue Tracker
          Issue Type: Patch
          Components: Bro
    Affects Versions: 2.1
         Environment: Ubuntu
            Reporter: Michael Stone


MSIE 11.0 currently shows up as <unknown browser>.  It looks like MS might have changed it's user agent string and doesn't include "MSIE".  I added the following to /usr/local/bro/share/bro/base/frameworks/software/main.bro
just below the "MSIE" block and above the "Safari" block.

else if ( /Trident\/7.0/ in uparsed_version ) 
   {
   if ( /rv:11\.0/ in unparsed_version ) {
       software_name = "MSIE";
       v = [$major=11,$minor=0];
      }
   }

Disclaimer: I'm fairly new to working with Bro so this might not be the best way, but it seems to be working for me.
Thanks!



--
This message was sent by Atlassian JIRA
(v6.2-OD-03#6206)