topic Re: URL expression in General Topics

URL expression

oitspa — Thu, 14 Mar 2013 12:50:19 GMT

please, how to write url expression if I want to block all domains including some word e.g.xxxx.

exapl blocked domain nicexxxxday.***

Re: URL expression

BCH — Thu, 14 Mar 2013 13:01:12 GMT

Hi, use a custom URL category to achieve this

"Objects" tab, > "Custom URL Category" to create it.

You can match entire domains or use wildcards if you need.

Re: URL expression

oitspa — Thu, 14 Mar 2013 13:28:05 GMT

I need wildcard but dont know how to write it for this case - looking for a word somewhere inside the domain

Thank you for help

Re: URL expression

BCH — Thu, 14 Mar 2013 13:41:02 GMT

Well in this case you can create a custom application signature with a simple regex containing any words you like.

For example, you can match the context "http-req-host-header" with the required regex to filter on domain names.

Please also have a look at https://live.paloaltonetworks.com/docs/DOC-1499 if it can help you.

Re: URL expression

oitspa — Thu, 14 Mar 2013 14:39:02 GMT

I tried to create signature butI cannot commit it because word is shorter than 7 letters. Is there any workaround?

Re: URL expression

BCH — Thu, 14 Mar 2013 14:46:36 GMT

Yes, the match engine requires at least 7 consecutive bytes for filters.

What does your filter look like at the moment ?

Re: URL expression

oitspa — Thu, 14 Mar 2013 14:54:46 GMT

at this moment I only try to solve requirement, I created test rule with signature as you propose. In pattern field I wrote .*(xxxxxx)

(xxxxxx is word I have to block in all web requests)

Re: URL expression

oitspa — Thu, 14 Mar 2013 19:23:47 GMT

any idea, how to solve it?

many thanks

Re: URL expression

BCH — Fri, 15 Mar 2013 08:26:14 GMT

As explained by Mikand here : https://live.paloaltonetworks.com/message/25100#25100

You can add wildcards at the beginning and/or the end of an expression to get past the 7-bytes limitation

Re: URL expression

oitspa — Fri, 15 Mar 2013 09:44:35 GMT

hmm, I tried to type .*xxxxxx.* into the field pattern but again - Operation failed

-> signature -> test -> and-condition -> And Condition 1 -> or-condition -> Or Condition 5 -> operator -> pattern-match -> pattern '.*xxxxxx.*' is invalid. pattern must be at least 7 bytes