How to customize a special Cross-Site Scripting blocking signature?

AFY-admin — Sun, 30 Sep 2018 02:42:16 GMT

Cross-Site Scripting:

http://xxx.xxx.xxx/search~S5*cht/?searchtype=X&searcharg=1234&searchscope=5&sortdropdown=-&SORT=DZ&extended=0&SUBMIT=%E6%9F%A5%E8%A9%A2&searchlimits=%22%20oNmOuSeOvEr%3dalert(%2720180305_XSS_VUL_DETECTED%27)%20%22%EF%BB%BF&searchorigarg=X1234

This is F5 ASM customize signature:

paloalto how to customize????
=========================
profile:CUS_oNmOuSeOvEr
Signature Type:Request
Systems:Unix/Linux、Apache、Apache Struts、Apache Tomcat
Attack Type:information Leakage
Rule:Advanced edit mode
pcre:"/[oO][\+]{0,5}[nN][\+]{0,5}[mM][\+]{0,5}[oO][\+]{0,5}[uU][\+]{0,5}[sS][\+]{0,5}[eE][\+]{0,5}[oO][\+]{0,5}[vV][\+]{0,5}[eE][\+]{0,5}[rR]/";

topic How to customize a special Cross-Site Scripting blocking signature? in Custom Signatures

How to customize a special Cross-Site Scripting blocking signature?