12-14-2016 05:23 PM
So I'm surprised that the Palo Alto doesn't have a signature to detect OpenVAS scanners. I would like to create a simple rule that detects "User-Agent: OpenVAS" (Ultimately I would like to just block these entirely.
Is something that can be easily built?
12-14-2016 05:33 PM
Please refer to the thread on this forum:
This has an example on how to detect Nikto Scanner traffic by sigging off the user-agent:
Example 2: Detecting Nikto Scans through User Agent (Nikto User Agent.xml)
The same thing can be achieved for OpenVAS by simply modifying the value in the user-agent field in the signature to "OpenVAS".
The signature can then be used in policy to alert/block etc.
02-28-2018 11:44 AM
I could not get the OpenVAS signature to work by just switching Nikto for OpenVAS. I had to do a more basic string <pattern>OpenVAS</pattern> . I actually did <pattern>OpenVAS 8</pattern> at first to see if that would work, it did. (OpenVAS 8.0.9 was the user agent.
Make sure you edit the entry name if you use my .xml file. You might already have that number in use. Also created one for Baiduspider since my IDS picked it up in a scan and I saw the user agent string for it.
There's a few useful links that will show user agent strings for popular scanners/crawlers.
https://developers.whatismybrowser.com/useragents/explore/software_type_specific/crawler/9
http://www.useragentstring.com/pages/useragentstring.php?typ=Crawler
Hope that helps, thanks -Rags
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
