Can I create a custom file type?

[eugenep]

As per the subject, is this possible to do?

We'd like to have specific types of files logged when it enters or leaves our network but since there is no such file type on the system, it isn't being logged.

Thanks

[Phoenix]

Hello eugenep,

We can create custom applications based on what file type you are looking for. The details about creating custom apps by analyzing a pattern is shared in the below document.

Custom Application Signatures

Thanks

[eugenep]

Hi Phoenix,

Thanks for your response but I'm after a custom file type, so I can see the file itself in my data filtering logs.  I don't want to change the application used to transfer the file type.

Thanks

[dyang · Accepted solution]

Hi Eugene,

Unfortunately, there is no way for you to create a custom file type signature.  If you would like to see this feature in a future PAN-OS release, please contact your SE or Sales representative so they can accurately capture the request.  In the meantime, you can use either a custom App-ID or a custom vulnerability signature for some form of detection, though as you've mentioned, these will not show in the data filtering logs.

--Doris

[eugenep]

Hi Doris,

Thanks for the confirmation.  I am currently using a custom vulnerability signature to detect the transfer of the file and it does appear in my threat logs.

I will bring it up with my SE.

Thanks

[dyang]

Great news, Eugene!

For what it's worth, may I ask what file type you're trying to detect?  Aside from requesting the ability to create a custom file type signature, you may also want to request for us to add an additional file type to our built-in signatures.  The appropriate team will evaluate your request, and if they decide to add it, a new signature could be delivered via content, which is a lot faster than waiting for a PAN-OS software release.  Either way, please bring this up with your SE.

--Doris

[eugenep]

I want to add the ability to detect EXR files (OpenEXR - Wikipedia, the free encyclopedia).  I work for a Media and Entertainment company and this one of the image file formats we use and we want to be able to detect and log this file type.

Thanks,

Eugene