Hello all, from a Security Logging point of view , it will be good to be able to extract "Client User Agent String". Is it possible through osquery?

Extract it from where? Installed browsers?

Yes, installed and used browsers. I know there is still a possibility users can use a switcher but the info that it has is valuable, so curious.

Nothing built-in to osquery. It seems a strange place to be querying for that, but off the top of my head you would need to identify where each browser stored that in code, which might not be accessible if it's inside a binary. If it's in a plist or a sqlite db somewhere (presuming macOS), you could use the

plist

table to parse it or ATC to build a table with the information from the sqlite db. On Windows if it's in the registry, you could use the

registry

table to read the value.

Awesome. Thank you for the information. I knew it was long shot but i guess i still wanted to give it as shot and ask.

I don't think they're stored externally to the browser binary itself, which osquery can't reach into, but if you find out otherwise I'd be curious to know.

The biggest problem is the browser addons like switchers. So every bit of information we get is still questionable. I will look into this too.

What is the usecase?

we have customers requesting these details for analyzing browser time vs server time from logs

https://searchfox.org/mozilla-central/source/netwerk/protocol/http/nsHttpHandler.cpp#889 In Firefox it appears to be built in code - so unless you're parsing memory, I think you have to go with "joining found browser version with expected user agent"

Thank you. I will research into these.