Create a URL filter for an arbitrary string?

[mbrownnyc]

Hello,

I'd like to create a URL filter to block/deny any URL that has an arbitrary string in it.

I was referred to this forum by Palo Alto Support.

In this specific case, the string I'd like to block is "Automated_Clearing_House_transaction".

How can I do this?

Thanks,

Matt

[drogers · Accepted solution]

For this case you will want to create a custom Vulnerability signature with a pattern match for string in the http-req-uri-path context. 

[lewis]

I agree, accomplished similar blocks with this method

[mbrownnyc]

Thanks all.

For this case, would the following regex work?

.*Automated_Clearing_House_transaction.*

Which regex engine does PAN use so I can find a tester?

How do I apply this to a policy?

[drogers]

Regex is done in custom hardware, so it's not just a standard off-the-shelf engine, but for these purposes it's close enough to PCRE.  In fact since you're just doing a string match simply using Automated_Clearing_House_transaction will work.

I created and tested a signature with the following config:

and it worked on a test url:

The XML for the signature is:

drogers@Captain.America# show threats vulnerability 42001 signature

    <signature>

      <standard>

        <entry name="ACH">

          <and-condition>

            <entry name="And Condition 1">

              <or-condition>

                <entry name="Or Condition 1">

                  <operator>

                    <pattern-match>

                      <pattern>Automated_Clearing_House_transaction</pattern>

                      <context>http-req-uri-path</context>

                      <negate>no</negate>

                    </pattern-match>

                  </operator>

                </entry>

              </or-condition>

            </entry>

          </and-condition>

          <order-free>no</order-free>

          <scope>protocol-data-unit</scope>

        </entry>

      </standard>

    </signature>

[mbrownnyc]

I'm actually trying to handle:

https://www.google.com/url?q=https%3A%2F%2Fwww.dropbox.com%2Fs%2F3629en16p7n2gyg%2FAutomated_Clearing_House_transaction6971.doc%3Fdl%3D1&sa=D&sntz=1&usg=AFQjCNHcCM7TtsC5x7MLN8ha5av6hCxdRw

I ended up using:

.*Automated_Clearing_House_transaction.*\.doc.*

I used this to test: http://regexpal.com/

What do you think?

Any way to make the regex case insensitive?

(?i).*Automated_Clearing_House_transaction.*\.doc.*

is not accepted by PAN.

[update]

Local SE confirmed that there is no case-insensitive support... would utilize too much CPU.

Thanks!

[DonohoeRobert]

Hi,

This way may be easier..

How to Filter Certain Search Strings using URL Filtering

Best regards

Rob