Can we remove URL indicators with specific keyword ?

[shanu2405]

Hello,

I am trying to push Cofense indicators to different devices, but want to exclude some URLs as those are not accepted by the devices.

I want to ignore URLs with sign "√" and "@" in domain.

http://google.com@ashousingcompany.com/www/?
http://google.com@drpinfra.com/www/?

https://send01.secureserver.cyou/√ExpressD.√----/
https://send01.secureserver.cyou/√ExpressD.√----/%3CCUSTOM%3E
https://send01.secureserver.cyou/√ExpressD.√----/login.php

Thanks in advance

[BPry]

@shanu2405,

https://live.paloaltonetworks.com/t5/minemeld-articles/configuring-nodes/ta-p/77185

That article should point in in the right direction. Take a look at ignore_regex and filter sets in particular.