New User Agent Per User
Detects when a user begins using a previously unseen HTTP user agent string. Uses 30-day metrics to baseline each user's known user agents. Fires when a new user agent appears for a user who has been active for at least 2 days, indicating possible tooling changes, unauthorized software, or adversary-introduced utilities.
YARA-L
