topic Re: Can I create a custom file type? in General Topics

Can I create a custom file type?

eugenep — Wed, 11 Dec 2013 01:04:08 GMT

As per the subject, is this possible to do?

We'd like to have specific types of files logged when it enters or leaves our network but since there is no such file type on the system, it isn't being logged.

Thanks

Re: Can I create a custom file type?

Phoenix — Wed, 11 Dec 2013 15:24:34 GMT

Hello eugenep,

We can create custom applications based on what file type you are looking for. The details about creating custom apps by analyzing a pattern is shared in the below document.

Custom Application Signatures

Thanks

Re: Can I create a custom file type?

eugenep — Wed, 11 Dec 2013 23:13:54 GMT

Hi Phoenix,

Thanks for your response but I'm after a custom file type, so I can see the file itself in my data filtering logs. I don't want to change the application used to transfer the file type.

Thanks

Re: Can I create a custom file type?

dyang — Wed, 11 Dec 2013 23:21:25 GMT

Hi Eugene,

Unfortunately, there is no way for you to create a custom file type signature. If you would like to see this feature in a future PAN-OS release, please contact your SE or Sales representative so they can accurately capture the request. In the meantime, you can use either a custom App-ID or a custom vulnerability signature for some form of detection, though as you've mentioned, these will not show in the data filtering logs.

--Doris

Re: Can I create a custom file type?

eugenep — Wed, 11 Dec 2013 23:25:52 GMT

Hi Doris,

Thanks for the confirmation. I am currently using a custom vulnerability signature to detect the transfer of the file and it does appear in my threat logs.

I will bring it up with my SE.

Thanks

Re: Can I create a custom file type?

dyang — Wed, 11 Dec 2013 23:30:07 GMT

Great news, Eugene!

For what it's worth, may I ask what file type you're trying to detect? Aside from requesting the ability to create a custom file type signature, you may also want to request for us to add an additional file type to our built-in signatures. The appropriate team will evaluate your request, and if they decide to add it, a new signature could be delivered via content, which is a lot faster than waiting for a PAN-OS software release. Either way, please bring this up with your SE.

--Doris

Re: Can I create a custom file type?

eugenep — Wed, 11 Dec 2013 23:39:52 GMT

I want to add the ability to detect EXR files (OpenEXR - Wikipedia, the free encyclopedia). I work for a Media and Entertainment company and this one of the image file formats we use and we want to be able to detect and log this file type.

Thanks,

Eugene