topic How to block a file based on Content Disposition? in Automation/API Discussions https://live.paloaltonetworks.com/t5/automation-api-discussions/how-to-block-a-file-based-on-content-disposition/m-p/39213#M908 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>We are trying to block specific files based on the content disposition.&nbsp; Using all the different context values for http traffic has proven ineffective.&nbsp; The issue is that we don't see the file name until the end of the file download.&nbsp; A screen shot of the packet capture is shown.&nbsp; Support has not been successful at providing me how to identify the file name so I can block it.</P><P></P><P><A _jive_internal="true" href="https://live.paloaltonetworks.com/servlet/JiveServlet/showImage/2-35600-10213/Capture-wireshark-data.PNG.png"><IMG alt="Capture-wireshark-data.PNG.png" class="jive-image jiveImage" height="506" src="https://live.paloaltonetworks.com/legacyfs/online/10267_Capture-wireshark-data.PNG.png" width="1016" /></A></P><P></P><P>We current create custom signatures and are familiar with the PA reference document. Any ideas would be helpful.</P><P></P><P>Phil</P></BODY></HTML> Mon, 16 Dec 2013 02:47:22 GMT HITSSEC 2013-12-16T02:47:22Z How to block a file based on Content Disposition? https://live.paloaltonetworks.com/t5/automation-api-discussions/how-to-block-a-file-based-on-content-disposition/m-p/39213#M908 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>We are trying to block specific files based on the content disposition.&nbsp; Using all the different context values for http traffic has proven ineffective.&nbsp; The issue is that we don't see the file name until the end of the file download.&nbsp; A screen shot of the packet capture is shown.&nbsp; Support has not been successful at providing me how to identify the file name so I can block it.</P><P></P><P><A _jive_internal="true" href="https://live.paloaltonetworks.com/servlet/JiveServlet/showImage/2-35600-10213/Capture-wireshark-data.PNG.png"><IMG alt="Capture-wireshark-data.PNG.png" class="jive-image jiveImage" height="506" src="https://live.paloaltonetworks.com/legacyfs/online/10267_Capture-wireshark-data.PNG.png" width="1016" /></A></P><P></P><P>We current create custom signatures and are familiar with the PA reference document. Any ideas would be helpful.</P><P></P><P>Phil</P></BODY></HTML> Mon, 16 Dec 2013 02:47:22 GMT https://live.paloaltonetworks.com/t5/automation-api-discussions/how-to-block-a-file-based-on-content-disposition/m-p/39213#M908 HITSSEC 2013-12-16T02:47:22Z