topic Re: How Can I create custom application? in General Topics

How Can I create custom application?

SilverTiger — Fri, 30 Aug 2013 01:25:33 GMT

Hello Family~

I would like to create custom application,,

but It is hard to do

anyway

recently I red custom application document

about uploading.com

\. <- why include \ character?

I tried to what could have known where document;;

help me please,,

Re: How Can I create custom application?

sraghunandan — Fri, 30 Aug 2013 02:15:51 GMT

I think you are referring to this doc https://live.paloaltonetworks.com/docs/DOC-2015.

\. is a regex pattern which is being used https://live.paloaltonetworks.com/docs/DOC-1499

For regex pattern to work we need atleast 7 characters with no interpreted characters.

In this case you can very well use uploading.com without any \. What \. does is escape the period.

Following discussion talks more about regex pattern matches

https://live.paloaltonetworks.com/message/28486

Re: How Can I create custom application?

cstancill — Fri, 30 Aug 2013 05:21:23 GMT

Tiger,

The \ 'escapes' the following character (in this case a '.') so that the regex engine treats it as a normal character instead of the regex special character '.' Without escaping first, the regex engine treats that period as a sort of wildcard character that will match anything but a newline. Escaping it causes the engine to treat is as an actual period to be matched against. Hopefully this helps.

Re: How Can I create custom application?

Interface — Fri, 30 Aug 2013 06:19:45 GMT

Hi,

try watch this video - https://live.paloaltonetworks.com/videos/1317 Maybe this will help

Re: How Can I create custom application?

craymond — Fri, 30 Aug 2013 13:44:40 GMT

Creating a custom app is actually fairly simple to do, it is just a little hard to understand . There is a simple way, and a more complex way. The complex way is a much more useful tool. The simple way is to create a custom app by clicking add in application objects, give it a name and then check the box marked Continue scanning for other Applications. Then click on policies tab and select application override. Click add and name it, give it a source and destination, and the port(s) that it uses, select the custom application that you created and presto you have that unknown-tcp or unknown-upd traffic show in the logs as your custom app.

The more complex method entails actually packet capturing the traffic and creating a signature based on that traffic. The document that sraghunandan, posted:

https://live.paloaltonetworks.com/docs/DOC-2015 does a far better job of explaining that I could. For non-http traffic, I have used unknown-req-tcp-payload, and hex string matches, with defined ports. Just remember the \x at the beginning and the end!