Rare User Agent by Distinct Hosts

Daniel Koifman@Koifsec

•updated Mar 1, 2026•2•0•71

This rule detects HTTP user-agent strings that appear on multiple distinct source hosts over a time period with multiple total requests, after excluding empty/null user-agents and known bot/monitoring strings (Googlebot, bingbot, Slackbot, monitoring).