https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/ta-p/1230301 <H2 class="lia-align-center"><FONT color="#FF6600"><STRONG>Palo Alto Networks 7-byte Custom Signature Minimum Removed in Newer Versions and Why it Matters!</STRONG></FONT></H2> <P>&nbsp;</P> <P>In the newer versions after 9.1, Palo Alto Networks now does not have 7-byte minimum length limit and is really useful, as an example, to make a signature that will block traffic to a web page if too many times the login parameter "user" is seen in the HTTP requests query or body parameters from a source IP address.&nbsp;</P> <P>&nbsp;</P> <P>Before the "user" parameter will not be allowed as it was to small below 7 bytes, so the web app needed to be changed to use something like "username" for example.</P> <P>&nbsp;</P> <P>In this article, I will show the how using the below match condition with combination match (it adds the number of the signature is triggered before taking an action) will trigger brute force protection of a web page login page.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nikoolayy1_0-1746792158016.png" style="width: 1320px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/67506i41281E5D6926CA2C/image-dimensions/1320x629?v=v2" width="1320" height="629" role="button" title="nikoolayy1_0-1746792158016.png" alt="nikoolayy1_0-1746792158016.png" /></span></P> <P>&nbsp;</P> <P>This is also really useful for Layer 3 and Layer 4 signatures that are supported at 11.x and newer as TCP or UDP flags could be less than the previous limit!</P> <P>&nbsp;</P> <H3><STRONG>Reference Materials:</STRONG></H3> <UL> <LI><A href="https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/custom-application-and-threat-signatures/custom-signature-pattern-requirements" target="_blank" rel="noopener">Custom Signature Pattern Requirements</A></LI> <LI><A href="https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/content-inspection-features/support-for-custom-layer3-and-layer4-threat-signatures" target="_blank" rel="noopener">Support for Custom Layer 3 and Layer 4 Threat Signatures</A></LI> </UL> <P>&nbsp;</P> Fri, 30 May 2025 17:28:05 GMT nikoolayy1 2025-05-30T17:28:05Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/ta-p/1230301 <P>Using the capability of the Palo Alto NGFW and Prisma Access to write custom application and Vulnerability signatures helps Security engineers to implement many custom protections, specific to their network environment.</P> Fri, 30 May 2025 17:28:05 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/ta-p/1230301 nikoolayy1 2025-05-30T17:28:05Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/tac-p/1230706#M801 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/153031">@nikoolayy1</a>&nbsp;,</P> <P>&nbsp;</P> <P>Great use-case ! Thanks for putting this together !</P> Mon, 02 Jun 2025 14:28:15 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/tac-p/1230706#M801 kiwi 2025-06-02T14:28:15Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/tac-p/1231116#M805 <P>Great post&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/153031">@nikoolayy1</a>!&nbsp;The removal of the 7-byte minimum length requirement after PAN-OS 9.1 is a real game-changer for creating more precise signatures.&nbsp;Thanks for sharing this practical insight!</P> Thu, 05 Jun 2025 19:28:43 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/tac-p/1231116#M805 emgarcia 2025-06-05T19:28:43Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/tac-p/1231344#M810 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/153031">@nikoolayy1</a>&nbsp;- 3 great helpful technical articles in one month!&nbsp; WOW!</P> Mon, 09 Jun 2025 20:24:59 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-7-byte-custom-signature-minimum-removed-in/tac-p/1231344#M810 crasmussen 2025-06-09T20:24:59Z