# How to add a new user-agent to blocking?

**URL:** <https://discourse.crowdsec.net/t/how-to-add-a-new-user-agent-to-blocking/1003>\
**Category:** crowdsec\
**Created:** [November 3, 2022, 1:25pm UTC](https://discourse.crowdsec.net/t/how-to-add-a-new-user-agent-to-blocking/1003 "2022-11-03T13:25:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ne20002](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/ne20002/32/1012_2.png) [@ne20002](https://discourse.crowdsec.net/u/ne20002)\
**Post date:** [November 3, 2022, 1:25pm UTC](https://discourse.crowdsec.net/t/how-to-add-a-new-user-agent-to-blocking/1003/1 "2022-11-03T13:25:27Z")

</div>

Hi  
Modsecurity detected a scan with a ‘User-Agent: Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)’ header due to wrong ‘Accept-Charset’ header …

Seeing this I wonder

- what I need to do to detect this with Crowdsec directly? Any scenario for this or can I add this string easily to an existing scenario?

- how can I order the detection? So that Crowdsec scenarios for this come first and modsecurity as last in chain?

---

<div class="post-metadata">

**Author:** ![blu-IT](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/blu-it/32/461_2.png) [@blu-IT](https://discourse.crowdsec.net/u/blu-IT)\
**Post date:** [November 14, 2022, 7:16pm UTC](https://discourse.crowdsec.net/t/how-to-add-a-new-user-agent-to-blocking/1003/2 "2022-11-14T19:16:49Z")

</div>

Hi,

are you talking about the " http-bad-user-agent" scenario?

[https://hub.crowdsec.net/author/crowdsecurity/configurations/http-bad-user-agent](https://hub.crowdsec.net/author/crowdsecurity/configurations/http-bad-user-agent)

There is a list that the scenario refers to:

[https://raw.githubusercontent.com/crowdsecurity/sec-lists/master/web/bad\_user\_agents.regex.txt](https://raw.githubusercontent.com/crowdsecurity/sec-lists/master/web/bad_user_agents.regex.txt)

So I think your input should be placed there or you modify the scenario to a local list.

---

<div class="post-metadata">

**Author:** ![ne20002](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/ne20002/32/1012_2.png) [@ne20002](https://discourse.crowdsec.net/u/ne20002)\
**Post date:** [November 15, 2022, 8:42am UTC](https://discourse.crowdsec.net/t/how-to-add-a-new-user-agent-to-blocking/1003/3 "2022-11-15T08:42:08Z")

</div>

Basically neither option really suits what I would expect which is

- get an updated list of user-agents when I update the software/packages/scenarios
- be able to add a bad user agent for my local installation

Maybe supporting two lists by default, one unmodifyable/retrieved from the scenario and an optional local list for this would be a solution?

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [November 15, 2022, 11:09am UTC](https://discourse.crowdsec.net/t/how-to-add-a-new-user-agent-to-blocking/1003/4 "2022-11-15T11:09:35Z")

</div>

Hello !

> [@ne20002](#):
>
> - get an updated list of user-agents when I update the software/packages/scenarios

It is something we’re working on. Currently data-files are not updated when you update the hub ☹