How to specify multiple conditions for the "test custom-signature-perf" command

Y.Narita347153 — Wed, 27 Aug 2025 07:37:09 GMT

Hello Team,

I'm currently creating a custom signature.

I'm checking performance using the following command.

test custom-signature-perf context <context> pattern <pattern>

https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/custom-application-and-threat-signatures/testing-pattern-performance-impact

Does anyone know if it's possible to specify multiple <pattern>s with an AND condition?

Best Regards,

Re: How to specify multiple conditions for the "test custom-signature-perf" command

nikoolayy1 — Mon, 08 Sep 2025 16:40:33 GMT

Yes you can but then all patterns will need to match. I have also made an article about custom signatures that show the "OR" pattern but the "AND" pattern can also be used:

How to Write Palo Alto Networks Custom Vulnerability and Application Signatures with Examples

If you see issues you can also make sever custom signatures each for each pattern and then make another custom signature referensing the threat id's of the previous signatures with AND condition. This could be needed if you try to match the same packet part with the different string matches like "if header Example has keyword 'maybe' " and then another "if header Example has keyword 'why' " as the processing could have moved on after the first condition to the next part of the packet.

Also always use "Qulifiers" to limit the Performance impact like HTTP methods where to trigger the match.

topic Re: How to specify multiple conditions for the "test custom-signature-perf" command in Custom Signatures

How to specify multiple conditions for the "test custom-signature-perf" command

Re: How to specify multiple conditions for the "test custom-signature-perf" command