topic Re: HTTP DDoS attack block signature in General Topics

HTTP DDoS attack block signature

kdaitadmin225 — Fri, 21 Mar 2014 05:39:51 GMT

I need to know how to create a custom signature to block HTTP DDoS attack signature against our Web server.

The common pattern I can observe in the attack is - either (1) Automated specific URL access or (2) URL access request with Cache-Control: no-cache\r\n\

I appreciate your comments or suggestions.

Sincerely yours, Mike

Re: HTTP DDoS attack block signature

kdd — Fri, 21 Mar 2014 07:05:22 GMT

Hi Kdaitadmin,

please look here where they discussed http ddos and found a solution.

https://live.paloaltonetworks.com/message/29281#29281

maybe this meets you needs.

Regards Klaus

Re: HTTP DDoS attack block signature

kdaitadmin225 — Fri, 21 Mar 2014 15:28:32 GMT

Hi Klaus,

Thank you for your response.

I was looking at exact same post. The post said "Create the custom signature to block HTTP Packets with "Cache-control: no-store, must-revaridate\r\n",

but I just need to know how to create custom signature on our PA-500 box with PANOS 5.0.

If you know how to create a custom HTTP block signature, I much appreciate your support.

Sincerely yours, Mike

Re: HTTP DDoS attack block signature

kdd — Mon, 24 Mar 2014 07:58:34 GMT

Hi kdaitadmin,

to set up a signature go the objects tab, -> Application and -> Add

chose the parameter which will be shown in the log for this signature

and then go to the signature tab and choose add to open this menu

assign a signature name and choose the add condition you want

afterwards the menu with http header options appear

assign a pattern and to be more precise choose a qualifier / method. this depends on the context you have choosen before

pattern syntax

https://live.paloaltonetworks.com/docs/DOC-1499

hope this helps

Regards Klaus

Re: HTTP DDoS attack block signature

Phoenix — Mon, 24 Mar 2014 14:44:37 GMT

Hello kdaitadmin225,

Here are couple docs explaining creating of custom signatures for Apps and threats.

Custom Application Signatures

Creating Custom Threat Signatures

Hope this helps.