topic Re: Using custom URL categories in General Topics

Using custom URL categories

JackField — Wed, 06 Mar 2019 14:21:55 GMT

Hi guys,

We're trying to stop users from accessing webpages featuring 'momo' content.

We've set up the below custom URL category and it only blocks Google searches for momo while in incognito mode, and still allows Google image and Youtube results. Is there anything wrong with this, we may have gone OTT trying to get this to work:

Using asterisks gives us errors.

Thanks,

Re: Using custom URL categories

BPry — Wed, 06 Mar 2019 18:25:31 GMT

@JackField ,

You would be better off creating a custom threat signature for something like this instead of a URL category.

Re: Using custom URL categories

reaper — Thu, 07 Mar 2019 12:37:32 GMT

I agree with @BPry , url filtering will limit your scope while a custom threat will be able to inspect payload etc

Re: Using custom URL categories

JackField — Tue, 12 Mar 2019 10:11:36 GMT

Hi @reaper , @BPry ,

Thanks for the help. I've been looking into this and it certainly seems the right path.

I'm running into a brick wall at the moment though. My Regex's only work with limited effect, and once a search for the malicious term 'momo' has sucessfully established, my vulnerability protections no longer work. Could you please advise, I've listed them below.

A big part of the problem is that regex's have to be 7 bytes or larger without wildcard objects; so momo on it's own won't work.

Interestingly, one of my Regex's - momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo. - context = http-req-message-body - will block me from working on the custom vulnerability object after it's been commited. This is a good thing, since it shows the protection is working on websites holding 'momo' content, but it is only working on the firewall config. I have set up the security profiles and policies correctly, and decryption is enabled.

Here's the regex's that have only limited scope:

Context: http-req-params - Value: search\?q=(.*momo\+.*)

Context: http-req-params - Value: search\?q=(.*.momo.*)

Context: http-req-params - Value: search\?q=(.*.momo*.*)\&source=.

Context: http-req-params - Value: .*(q=momo&rlz=).*

Context: http-req-params - Value: search_query=(.*.momo.*).*

I know it's possible to create a condition that will block any webpage with momo on it, I'm just stumped as to how!

Thanks,