Custom Signatures

Welcome to the Custom Signatures Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Welcome to the Palo Alto Networks Custom Signature discussion board!

The purpose of this board is to discuss everything related to custom signature creation in PAN-OS devices. Palo Alto Networks delivers a large quantity of coverage in our weekly content updates; however, we know that our customers are staffed by dedi

...

Example to detect SMTP 550 (destination email address does not exist)

Here is an example to alert when a server responds with SMTP 550 (mailbox does not exist). The context used is 'smtp-rsp-content' and the pattern to be matched is '550\ 5\.1\.1'.
<pattern>550\ 5\.1\.1</pattern>
<context>smtp-rsp-content</context>

Ful

...

Honey pot signature

Hi,

I have certain subnets that are currently not in use in our domain, I wanted to ip-block for 30 minutes all ips that access any of these subnets. Is it possible to creat a threat signature for this?

Thanks,

VIREN

Custom Signatures

Discussions

Welcome to the Custom Signatures Discussions!

Rules and Best Practices

Welcome to the Palo Alto Networks Custom Signature discussion board!

Example to detect SMTP 550 (destination email address does not exist)

Honey pot signature

Custom Vulnerability to Block Old Browser Versions

Threat signature for ICMP type

Pattern regex less then 7 bytes

Custom threat signature- search full TCP payload of any AppId

Custom Signature to allow LDAPS as SSL port 636

Unlock your full community experience!

Custom Signatures

Rules and Best Practices