Internal Tool
Firewall User-Agent Analysis Tool
I designed and built an automated firewall log analysis tool that identifies suspicious User-Agent activity and supports more informed WAF tuning and security investigations.
As part of my application security work, I developed an internal automation tool to analyze firewall logs and surface potentially malicious User-Agent activity that could otherwise be overlooked during manual review. The system parses F5/WAF logs, compares observed User-Agent strings against a maintained database of approximately 1,500 suspicious signatures, and highlights activity worth further investigation. By automating this recurring analysis, the tool helps security teams focus their attention on meaningful signals while providing additional context for firewall rule improvements.
Role
Application Security Analyst / Sole Designer & Developer
Status
Internal security tooling. Interface and data recreated for confidentiality.
Project type
Internal Tool
Primary discipline
Security
Year
2025–Present
Capabilities
Environment
Enterprise Application Security
Context
Internal Security Operations
Platform
Python
Scope
Firewall Log Analysis
Confidentiality
Screens recreated for portfolio
Suspicious signatures
~1,500
Analysis cadence
Every 24 hours
Log source
F5 / WAF
Modern application security teams collect enormous volumes of firewall data, but manually reviewing that information for meaningful patterns can be both repetitive and time-consuming. I built this tool to automate one small but valuable part of that workflow: identifying suspicious User-Agent activity that may indicate scanners, automated attacks, or other potentially malicious traffic.
Rather than replacing analyst judgment, the system acts as an additional layer of intelligence. By comparing observed User-Agent strings against a curated list of known suspicious signatures, it helps narrow the investigation surface and provides useful context for firewall tuning and ongoing security operations.
Context
The challenge
Enterprise firewall logs contain an enormous amount of information, but identifying meaningful security signals within that data often requires repetitive manual review. Suspicious User-Agent strings can provide valuable clues about automated scanners, reconnaissance activity, or known attack tooling, yet they are easy to miss when buried among normal traffic.
The goal was to automate this recurring analysis without disrupting existing security workflows. Rather than replacing analysts, the system was designed to highlight activity that deserved closer inspection while providing additional information that could support firewall improvements.
Strategy
Designing the system
The project focused on building a lightweight analysis pipeline that could continuously process firewall logs and identify User-Agent strings associated with known malicious or suspicious behavior.
Instead of relying solely on raw log inspection, the tool compares observed User-Agent values against a maintained database of approximately 1,500 suspicious signatures. By automating this comparison on a recurring schedule, the system provides consistent analysis while reducing the manual effort required to identify patterns across large log datasets.
The design intentionally emphasizes operational simplicity, allowing the analysis to become part of an ongoing security workflow rather than a one-time investigation.
System
System features
Detail
Automated log processing
The tool parses F5/WAF firewall logs and extracts User-Agent values for analysis on a scheduled basis.
Detail
Signature comparison
Observed User-Agent strings are compared against a maintained database of approximately 1,500 suspicious signatures to identify potentially malicious activity.
Detail
Suspicious activity identification
Rather than presenting every log entry equally, the system highlights traffic that deserves additional investigation, helping analysts prioritize their review.
Detail
Firewall improvement support
Detected patterns provide useful context for evaluating firewall behavior and identifying opportunities for future WAF tuning and blocking decisions.
Gallery
Analysis views
Results