topic Re: Create a URL filter for an arbitrary string? in Automation/API Discussions

Create a URL filter for an arbitrary string?

mbrownnyc — Tue, 21 Apr 2015 15:50:20 GMT

Hello,

I'd like to create a URL filter to block/deny any URL that has an arbitrary string in it.

I was referred to this forum by Palo Alto Support.

In this specific case, the string I'd like to block is "Automated_Clearing_House_transaction".

How can I do this?

Thanks,

Matt

Re: Create a URL filter for an arbitrary string?

drogers — Tue, 21 Apr 2015 15:59:12 GMT

For this case you will want to create a custom Vulnerability signature with a pattern match for string in the http-req-uri-path context.

Re: Create a URL filter for an arbitrary string?

lewis — Tue, 21 Apr 2015 16:23:36 GMT

I agree, accomplished similar blocks with this method

Re: Create a URL filter for an arbitrary string?

mbrownnyc — Tue, 21 Apr 2015 16:25:25 GMT

Thanks all.

For this case, would the following regex work?

.*Automated_Clearing_House_transaction.*

Which regex engine does PAN use so I can find a tester?

How do I apply this to a policy?

Re: Create a URL filter for an arbitrary string?

drogers — Tue, 21 Apr 2015 16:52:18 GMT

Regex is done in custom hardware, so it's not just a standard off-the-shelf engine, but for these purposes it's close enough to PCRE. In fact since you're just doing a string match simply using Automated_Clearing_House_transaction will work.

I created and tested a signature with the following config:

and it worked on a test url:

The XML for the signature is:

drogers@Captain.America# show threats vulnerability 42001 signature

<and-condition>

<or-condition>

<pattern-match>

<pattern>Automated_Clearing_House_transaction</pattern>

</pattern-match>

</operator>

</entry>

</or-condition>

</entry>

</and-condition>

<order-free>no</order-free>

<scope>protocol-data-unit</scope>

</entry>

</standard>

</signature>

Re: Create a URL filter for an arbitrary string?

mbrownnyc — Tue, 21 Apr 2015 17:06:55 GMT

I'm actually trying to handle:

https://www.google.com/url?q=https%3A%2F%2Fwww.dropbox.com%2Fs%2F3629en16p7n2gyg%2FAutomated_Clearing_House_transaction6971.doc%3Fdl%3D1&sa=D&sntz=1&usg=AFQjCNHcCM7TtsC5x7MLN8ha5av6hCxdRw

I ended up using:

.*Automated_Clearing_House_transaction.*\.doc.*

I used this to test: http://regexpal.com/

What do you think?

Any way to make the regex case insensitive?

(?i).*Automated_Clearing_House_transaction.*\.doc.*

is not accepted by PAN.

[update]

Local SE confirmed that there is no case-insensitive support... would utilize too much CPU.

Thanks!

Re: Create a URL filter for an arbitrary string?

DonohoeRobert — Wed, 27 May 2015 09:41:07 GMT

Hi,

This way may be easier..

How to Filter Certain Search Strings using URL Filtering

Best regards

Rob