Create a URL filter for an arbitrary string?

[mbrownnyc]

Hello,

I'd like to create a URL filter to block/deny any URL that has an arbitrary string in it.

I was referred to this forum by Palo Alto Support.

In this specific case, the string I'd like to block is "Automated_Clearing_House_transaction".

How can I do this?

Thanks,

Matt

[drogers · Accepted solution]

For this case you will want to create a custom Vulnerability signature with a pattern match for string in the http-req-uri-path context. 

[lewis]

I agree, accomplished similar blocks with this method

[mbrownnyc]

Thanks all.

For this case, would the following regex work?

.*Automated_Clearing_House_transaction.*

Which regex engine does PAN use so I can find a tester?

How do I apply this to a policy?

[drogers]

Regex is done in custom hardware, so it's not just a standard off-the-shelf engine, but for these purposes it's close enough to PCRE.  In fact since you're just doing a string match simply using Automated_Clearing_House_transaction will work.

I created and tested a signature with the following config:

and it worked on a test url:

The XML for the signature is:

drogers@Captain.America# show threats vulnerability 42001 signature

    <signature>

      <standard>

        <entry name="ACH">

          <and-condition>

            <entry name="And Condition 1">

              <or-condition>

                <entry name="Or Condition 1">

                  <operator>

                    <pattern-match>

                      <pattern>Automated_Clearing_House_transaction</pattern>

                      <context>http-req-uri-path</context>

                      <negate>no</negate>

                    </pattern-match>

                  </operator>

                </entry>

              </or-condition>

            </entry>

          </and-condition>

          <order-free>no</order-free>

          <scope>protocol-data-unit</scope>

        </entry>

      </standard>

    </signature>