How to specify multiple conditions for the "test custom-signature-perf" command

[Y.Narita347153]

Hello Team,

I'm currently creating a custom signature.

I'm checking performance using the following command.

test custom-signature-perf context <context> pattern <pattern>

https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/custom-application-...

Does anyone know if it's possible to specify multiple <pattern>s with an AND condition?

Best Regards,

[nikoolayy1]

Yes you can but then all patterns will need to match. I have also made an article about custom signatures that show the "OR" pattern but the "AND" pattern can also be used:

How to Write Palo Alto Networks Custom Vulnerability and Application Signatures with Examples

If you see issues you can also make sever custom signatures each for each pattern and then make another custom signature referensing the threat id's of the previous signatures with AND condition. This could be needed if you try to match the same packet part with the different string matches like "if header Example has keyword 'maybe' " and then another "if header Example has keyword 'why' " as the processing could have moved on after the first condition to the next part of the packet.

Also always use "Qulifiers" to limit the Performance impact like HTTP methods where to trigger the match.