topic Re: Push custom signature using API in General Topics

Push custom signature using API

ColaNet — Mon, 10 Jun 2019 14:13:51 GMT

Hello colleagues, how I can upload to firewall custom signature using api or cli interface?

Re: Push custom signature using API

reaper — Wed, 12 Jun 2019 19:13:41 GMT

somthing along these lines:

# set threats vulnerability 41000 direction both severity critical threatname mythreat signature standard mysignature scope session and-condition myandcondition or-condition myorcondition operator pattern-match pattern mYpAtTeRn context http-req-headers qualifier http-method value GET

Re: Push custom signature using API

ColaNet — Thu, 13 Jun 2019 07:27:55 GMT

Thanks for the answer, can you give examples or a detailed description of the addition of a specific signature? And why such a limit of 4000 signatures? In this case, the question is brewing - does the firewall or VF-500 store any signatures or hashes of secure files somewhere, will they not go to the scan each time?

Re: Push custom signature using API

reaper — Thu, 13 Jun 2019 11:40:46 GMT

I don't think i fully understand your question No hashes are saved, except for wildfire uploads

Re: Push custom signature using API

ColaNet — Thu, 13 Jun 2019 11:47:49 GMT

Please see this link https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUdCAK you can see here that you can add signatures using the web interface, I’m interested in automating the addition of such rules, because doing it every time with your hands is a long and difficult task. Best of course if you can automate using API.