Using custom URL categories

L0 Member

Using custom URL categories

Hi guys,

 

We're trying to stop users from accessing webpages featuring 'momo' content.

 

We've set up the below custom URL category and it only blocks Google searches for momo while in incognito mode, and still allows Google image and Youtube results.  Is there anything wrong with this, we may have gone OTT trying to get this to work:

 

URL category.png

 

Using asterisks gives us errors.

 

Thanks,

J

Tags (1)
L7 Applicator

Re: Using custom URL categories

@JackField ,

You would be better off creating a custom threat signature for something like this instead of a URL category. 

Community Manager

Re: Using custom URL categories

I agree with @BPry , url filtering will limit your scope while a custom threat will be able to inspect payload etc

 


Help the community: Like helpful comments and mark solutions
Reaper out
L0 Member

Re: Using custom URL categories

Hi @reaper , @BPry ,

 

Thanks for the help.  I've been looking into this and it certainly seems the right path.

 

I'm running into a brick wall at the moment though.  My Regex's only work with limited effect, and once a search for the malicious term 'momo' has sucessfully established, my vulnerability protections no longer work.  Could you please advise, I've listed them below.

 

A big part of the problem is that regex's have to be 7 bytes or larger without wildcard objects; so momo on it's own won't work.

 

Interestingly, one of my Regex's - momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo. - context = http-req-message-body - will block me from working on the custom vulnerability object after it's been commited.  This is a good thing, since it shows the protection is working on websites holding 'momo' content, but it is only working on the firewall config.  I have set up the security profiles and policies correctly, and decryption is enabled.

 

Here's the regex's that have only limited scope:

 

Context: http-req-params - Value: search\?q=(.*momo\+.*)

Context: http-req-params - Value: search\?q=(.*.momo.*)

Context: http-req-params - Value: search\?q=(.*.momo*.*)\&source=.

Context: http-req-params - Value: .*(q=momo&rlz=).*

Context: http-req-params - Value: search_query=(.*.momo.*).*

Context: http-req-message-body Value: momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo.

 

I know it's possible to create a condition that will block any webpage with momo on it, I'm just stumped as to how!

 

Thanks,

J

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!