topic Question about Custom Signature Patterns. in Automation/API Discussions

Question about Custom Signature Patterns.

mharding — Mon, 13 Sep 2010 16:07:55 GMT

Is there an explanation of each setting in the pattern files when creating custom spyware/vulnerabilities like in the screenshot below?

Re: Question about Custom Signature Patterns.

gmoerschel — Mon, 13 Sep 2010 17:50:40 GMT

I asked the same thing. Am waiting...

Re: Question about Custom Signature Patterns.

SRA — Tue, 14 Sep 2010 01:05:27 GMT

The names of the decoder-contexts in this list should be self-explanatory.

Are you looking for details on a specific decoder-context that you are trying to use?

Re: Question about Custom Signature Patterns.

rmonvon — Tue, 14 Sep 2010 01:07:56 GMT

Maybe this document will help explain those fields.

Re: Question about Custom Signature Patterns.

mharding — Tue, 14 Sep 2010 02:20:35 GMT

I was looking to create a pattern file based on certain words in the body of an email, but it doesn't look like I have the ability based on the descriptions in the PDF document.

Re: Question about Custom Signature Patterns.

rmonvon — Tue, 14 Sep 2010 03:12:31 GMT

You should try the Data Filtering feature, and write the regex to match the patterns/words. Then apply the Data Filtering profile to smtp, pop3, etc to scan your email application. The regex must have a 7-byte static string base. Please review the Data Filtering requirement for more info.

Cheers,