topic Re: block keywords in General Topics

block keywords

oitspa — Thu, 14 Mar 2013 08:36:16 GMT

Hello,

I need a advice. We need to block any keywords for our users. Could you edvice how to do it?

Thanks

Re: block keywords

reaper — Thu, 14 Mar 2013 08:52:24 GMT

If you mean to block keywords in for example documents and emails you could set up data filtering which will allow you to block sessions that contain certain keywords

here's a document that can help you on your way:

Re: block keywords

oitspa — Thu, 14 Mar 2013 09:05:15 GMT

hello I mean block keywords for web browsing

Re: block keywords

oitspa — Thu, 14 Mar 2013 11:04:04 GMT

I tried to create application whith definition own signature with keyword. Problem is that some keyword are shorter than min. lenght pattern field (7). How can I solve it?

Thanks

Re: block keywords

mikand — Fri, 15 Mar 2013 07:59:22 GMT

A workaround for the minimum pattern length (which I feel is bad - should be taken care of by the PANOS itself to extend any short patterns into whatever the hardware demands as minimum length) could be to add some wildcards before and after.

Something like:

.*TEXT.* <- 8 bytes in length

Re: block keywords

oitspa — Sun, 17 Mar 2013 16:01:57 GMT

hmm, I tried to type .*xxxxxx.* into the field pattern but again - Operation failed

-> signature -> test -> and-condition -> And Condition 1 -> or-condition -> Or Condition 5 -> operator -> pattern-match -> pattern '.*xxxxxx.*' is invalid. pattern must be at least 7 byte

Re: block keywords

Retired Member — Sun, 17 Mar 2013 16:09:19 GMT

this document will help I think.

Best Regards.

Re: block keywords

oscaringosv — Fri, 06 Jan 2017 16:36:58 GMT

Where's the document?? I have the same issue..

Re: block keywords

BPry — Fri, 06 Jan 2017 21:18:13 GMT

@oscaringosv If you try to trick it into allow fewer charactors PA will issue out a warning about it not being in a proper format and therefor it's invalid. If your regex gets shorter than 7 bytes then you get a ton of false hits and you start blocking/acting on stuff when you don't mean to.

Re: block keywords

oscaringosv — Fri, 06 Jan 2017 21:26:11 GMT

Thanks for your reply @BPry, and do you think this is possible via Custom Category?

https://live.paloaltonetworks.com/t5/General-Topics/URL-wildcard-Pattern/m-p/136217#U136217