topic Custom vulnerability object trigger in GlobalProtect Discussions

Custom vulnerability object trigger

M.Bathgate — Fri, 09 Aug 2024 02:18:44 GMT

Trying to use a custom vulnerability object to raise a threat alert when a user directly enters a request for access to an IPv4 address . eg http://12.34.56.78 . Ive created a object , with a pattern of (.*((?:\d{1,3}\.){3}\d{1,3})) and applied it to a vulnerability profile that is applied to a bunch of rules . I can see the rules triggered but the vulnerability is not logging as a threat , ive also had the converse where a normal URL eg http://www.xyz.com is being flagged as a vulnerability as a false positive . Anyone had success (consistently) with custom vulnerability objects using regex patterns ? the field im using the regex pattern against is http-req-host-headers

Re: Custom vulnerability object trigger

aleksandar.astardzhiev — Wed, 21 Aug 2024 12:07:07 GMT

Hi @M.Bathgate ,

As mentioned here - http-req-host-header Context (paloaltonetworks.com) you may need to specify start and end anchors

To initiate an exact match search, you must add a <space> before the pattern and ‘\r\n’ after the pattern on PAN-OS 9.1 and earlier. Starting with PAN-OS 10.0 you can use the following anchor characters: ^ and $ to specify a string start and end.

Also are you applying SSL decryption for this traffic? As you try to check the HTTP host header the firewall will need to decrypt the traffic first.

If not, you may need to use ssl-req-chello-sni (paloaltonetworks.com) for context

Re: Custom vulnerability object trigger

M.Bathgate — Wed, 21 Aug 2024 20:53:31 GMT

Thanks, tried those ^ $ wasnt sure if they were working or not at the time, as they seemed to make no difference . Re SSL , yes decrypted . As a test ive tried test sites under http and https , and again mixed results . Wondering if the policy isnt getting consistently applied for some reason

Re: Custom vulnerability object trigger

aleksandar.astardzhiev — Thu, 22 Aug 2024 06:12:12 GMT

Hey @M.Bathgate ,

Can you share the full custom vulnerability obect that you have created?

Are you using any Context Qualifiers (paloaltonetworks.com) ?

Re: Custom vulnerability object trigger

M.Bathgate — Thu, 22 Aug 2024 21:48:12 GMT

Those context qualifiers look interesting , but i havent used them , all ive done is a basic vulnerability object under custom objects , with a signature pattern specified against the http-req-host-header . Thanks for the headsup regarding context qualifiers , they look useful for some other purposes