Custom vulnerability Signature

[thanzeeer]

Hi,

I am trying to create a custom threat signature based on the HOST: header in the URL request and URI request field. The signarure is working as expected. Issue is when I tried to add a pattern which is less than 7 bytes in http-req-host-header field, the signature is not accepted by the device. 

Any help is appreciated.

Regards

Thanzeer

[santonic]

I've been there, it's an annoying restriction.

Try to add something that always appears in the header there. Or make up some 7 byte regex which always triggers.