# Pipeline Processor Rule to Detect Bad User Agent

**URL:** <https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [July 21, 2017, 9:08am UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808 "2017-07-21T09:08:51Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![GTownson](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gtownson/32/793_2.png) [@GTownson](https://community.graylog.org/u/GTownson)\
**Post date:** [July 21, 2017, 9:08am UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/1 "2017-07-21T09:08:51Z")

</div>

Hello,

I have tried to create a pipeline rule to check if the user agent is on a list of suspicious user agents.  
In the pipeline rule below I have only added the ‘Microsoft+WinRM+Client’ user agent as a test.

I have verified that we are getting logs in with the test user agent, however  
the BadUserAgent field isn’t being set to ‘Yes’.

Can anyone explain to me why this rule doesn’t work?

```
rule "Suspicious User Agent"
    when
    to_bool(regex("Microsoft+WinRM+Client", to_string($message.UserAgent)))

    then
set_field("BadUserAgent", "Yes");
end

```

Thankyou in advance

G

---

<div class="post-metadata">

**Author:** ![scampuza](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/scampuza/32/716_2.png) [@scampuza](https://community.graylog.org/u/scampuza)\
**Post date:** [July 21, 2017, 7:18pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/2 "2017-07-21T19:18:40Z")

</div>

G

It seems the problem is with the Regular Expression. Can you please share with us a sample of the log file containing this user agent?

---

<div class="post-metadata">

**Author:** ![GTownson](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gtownson/32/793_2.png) [@GTownson](https://community.graylog.org/u/GTownson)\
**Post date:** [July 21, 2017, 7:47pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/3 "2017-07-21T19:47:37Z")

</div>

I can’t currently share one sorry.

However the user agent is exactly the same as it is in the regex:‘Microsoft+WinRM+Client’

Regards

G

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 25, 2017, 12:01pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/4 "2017-07-25T12:01:29Z")

</div>

The `+` character is a reserved character in regular expressions. Additionally, the [`regex()`](http://docs.graylog.org/en/2.2/pages/pipelines/functions.html#regex) function returns the matching parts of the input string, not a boolean value.

Please refer to [https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html](https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html) and [http://www.vogella.com/tutorials/JavaRegularExpressions/article.html](http://www.vogella.com/tutorials/JavaRegularExpressions/article.html) for more information.

---

<div class="post-metadata">

**Author:** ![GTownson](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gtownson/32/793_2.png) [@GTownson](https://community.graylog.org/u/GTownson)\
**Post date:** [July 25, 2017, 1:14pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/5 "2017-07-25T13:14:31Z")

</div>

I am slightly versed in regex and had tried to escape the ‘+’

to\_bool(regex(“Microsoft+WinRM+Client”, to\_string($message.UserAgent)))

However this threw up the error:

 ![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/9c7ecec3deb1991e6d2d7d59d55bc362fdf736cd.png)

Is there anyway to match a field to regex and output a bool value to trigger the ‘then’ part of the pipeline rule?

Regards,  
G

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 25, 2017, 1:43pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/6 "2017-07-25T13:43:40Z")

</div>

Unfortunately `\` itself is a reserved character inside strings, so you have to escape that too, i. e. `"Foo\\+Bar"`.

---

<div class="post-metadata">

**Author:** ![GTownson](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gtownson/32/793_2.png) [@GTownson](https://community.graylog.org/u/GTownson)\
**Post date:** [July 25, 2017, 1:57pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/7 "2017-07-25T13:57:28Z")

</div>

I don’t need to escape the \ do I? as the string I’m trying to match the regex with is: Microsoft+WinRM+Client

So I only thought I’d have to escape the +

G

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 25, 2017, 2:02pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/8 "2017-07-25T14:02:49Z")

</div>

> [@GTownson](#):
>
> I don’t need to escape the \ do I?

Yes, the backslash has to be escaped too.

---

<div class="post-metadata">

**Author:** ![GTownson](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gtownson/32/793_2.png) [@GTownson](https://community.graylog.org/u/GTownson)\
**Post date:** [July 25, 2017, 2:06pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/9 "2017-07-25T14:06:09Z")

</div>

Ah ok, thanykou very much.

I shall test this out now 🙂

How would I then make the pipeline processor set the BadUserAgent field if the regex matched?

G

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 25, 2017, 2:15pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/10 "2017-07-25T14:15:58Z")

</div>

> [@GTownson](#):
>
> How would I then make the pipeline processor set the BadUserAgent field if the regex matched?

With [`set_field()`](http://docs.graylog.org/en/2.2/pages/pipelines/functions.html#set-field).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 8, 2017, 2:16pm UTC](https://community.graylog.org/t/pipeline-processor-rule-to-detect-bad-user-agent/1808/11 "2017-08-08T14:16:13Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.