block keywords

[oitspa]

Hello,

I need a advice. We need to block any keywords for our users. Could you edvice how to do it?

Thanks

[reaper]

Hi

If you mean to block keywords in for example documents and emails you could set up data filtering which will allow you to block sessions that contain certain keywords

here's a document that can help you on your way:

[oitspa]

hello I mean block keywords for web browsing

[oitspa]

I tried to create application whith definition own signature with keyword. Problem is that some keyword are shorter than min. lenght pattern field (7). How can I solve it?

Thanks

[mikand]

A workaround for the minimum pattern length (which I feel is bad - should be taken care of by the PANOS itself to extend any short patterns into whatever the hardware demands as minimum length) could be to add some wildcards before and after.

Something like:

.*TEXT.* <- 8 bytes in length

[oitspa]

hmm, I tried to type .*xxxxxx.* into the field pattern but again - Operation failed

-> signature -> test -> and-condition -> And Condition 1 -> or-condition -> Or Condition 5 -> operator -> pattern-match -> pattern '.*xxxxxx.*' is invalid. pattern must be at least 7 byte

[panos]

this document will help I think.

Best Regards.

[oscaringosv]

Where's the document?? I have the same issue..

[BPry]

@oscaringosv If you try to trick it into allow fewer charactors PA will issue out a warning about it not being in a proper format and therefor it's invalid. If your regex gets shorter than 7 bytes then you get a ton of false hits and you start blocking/acting on stuff when you don't mean to.

[oscaringosv]

Thanks for your reply @BPry, and do you think this is possible via Custom Category?

 https://live.paloaltonetworks.com/t5/General-Topics/URL-wildcard-Pattern/m-p/136217#U136217