What is user-agent information in a cloud log?¶
User-agent information is a string or set of fields describing the software that connected to a cloud service.
It may indicate a browser, operating system, application, device type or automated client.
What this means in practice¶
Many devices use the same browser and operating system. User-agent strings can also be incomplete, modified, spoofed or simplified by applications and providers.
Investigators should preserve the full value exactly as recorded.
A sudden change in user agent may indicate a new browser, application update, different device, automation or unauthorised access.
But normal updates and privacy features can also alter the value.
Where a user agent appears to identify a mobile application or API client, check whether the activity was interactive or automated.
User-agent evidence becomes stronger when it aligns with session, device and application records.
Where several records show the same user agent, treat that as consistency rather than uniqueness. Its evidential value comes from the wider pattern and any matching device artefacts.
If the provider normalises or parses the user agent into separate fields, preserve the original string as well as the interpreted browser and operating-system labels. Later parser changes may alter how the same raw value is displayed.
What this does not show on its own¶
The dangerous assumption is that a user agent uniquely identifies a physical device.
Some cloud logs provide richer device details separately, such as device ID, managed status or operating-system version. Do not merge those fields without understanding their source.
What to do next¶
Compare it with other events from the account, known devices, session identifiers, application IDs and device-management records.
Key takeaway
A user agent describes the connecting software, not a unique person or device, so use it comparatively and corroborate it with session and device evidence.