outdated web Brower

[kostasthedelegate]

Hello, 

I would like to know if there is a way to extract from WSA the info about the used browser version in the network. 

Either in logs or in reports or something else. 

thanks and regards, 

Konstantinos

[balaji.bandi]

You can get the information from Log subscription :

1611243019.446 546 x.x.x.x TCP_MISS/200 6824 CONNECT tunnel://domain.com:443/ -
DIRECT/domain.com application/octet-stream MONITOR_RULE-NONE-NONE-DefaultGroup-NONE
<"C_Glob",9.2,1,"-",-,-,-,1,"-",-,-,-,"-",1,-,"-","-",-,-,"IW_comp",-,"-","Computers and Internet","-","Microsoft Dynamics CRM","Enterprise Applications","Encrypted","-",99.99,0,-,"-","-",1,"-",-,-,"-","-",-,1,"-",-> -
0 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1 Safari/537.36", 2021-01-21, 15:30:19 Date:
"4/mar/2021:10:30:19 +0000" Dst-IP: x.x.x.x UsrAgnt: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1 Safari/537.36"
ADGroup: - AuthMethod: NONE TransID: 334130190 PrfPara: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 152 0 0 0 0 0 0
WBRS response = 0, WBRS total = 0, AVC response = 0, AVC total = 0, DCA response = 0, DCA total = 0, McAfee response = 0, McAfee total = 0, Sophos response = 0, Sophos total = 0, Webroot response = 0,
Webroot total = 0, Anti-Spyware response = 0, Anti-Spyware total = 0; 0

[kostasthedelegate]

Hello @balaji.bandi 

Are these the access logs?

[balaji.bandi]

yes, you can download that Logs in to Linux, you can use grep and AWK to get the report.

[kostasthedelegate]

Is this the default format, because I cannot find this field in the explanation here:

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_010111.html#con_1633384

[kostasthedelegate]

Found It!!

%u

cs(User-Agent)

User agent. This field is written with double-quotes in the access logs.

This field helps determine if an application is failing authentication and/or requires different access permissions.

Thank you @balaji.bandi 

[kostasthedelegate]

One more question @balaji.bandi 

UsrAgnt: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1 Safari/537.36"

In the log there are all the browsers.

Which is the one used by the user?