How Can I create custom application?

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L3 Networker

How Can I create custom application?

Hello Family~

I would like to create custom application,,

but It is hard to do

anyway

recently I red custom application document

about uploading.com

\.   <- why include \ character?

I tried to what could have known where document;;

help me please,,


Accepted Solutions
Highlighted
L5 Sessionator

I think you are referring to this doc https://live.paloaltonetworks.com/docs/DOC-2015.

\. is a regex pattern which is being used https://live.paloaltonetworks.com/docs/DOC-1499

For regex pattern to work we need atleast 7 characters with no interpreted characters.

In this case you can very well use uploading.com without any \. What \. does is escape the period.

Following discussion talks more about regex pattern matches

https://live.paloaltonetworks.com/message/28486

View solution in original post


All Replies
Highlighted
L5 Sessionator

I think you are referring to this doc https://live.paloaltonetworks.com/docs/DOC-2015.

\. is a regex pattern which is being used https://live.paloaltonetworks.com/docs/DOC-1499

For regex pattern to work we need atleast 7 characters with no interpreted characters.

In this case you can very well use uploading.com without any \. What \. does is escape the period.

Following discussion talks more about regex pattern matches

https://live.paloaltonetworks.com/message/28486

View solution in original post

Highlighted
L4 Transporter

Tiger,

      The \ 'escapes' the following character (in this case a '.') so that the regex engine treats it as a normal character instead of the regex special character '.' Without escaping first, the regex engine treats that period as a sort of wildcard character that will match anything but a newline. Escaping it causes the engine to treat is as an actual period to be matched against. Hopefully this helps.

Highlighted
L3 Networker

Hi,

try watch this video - https://live.paloaltonetworks.com/videos/1317 Maybe this will help :smileywink:

Highlighted
L4 Transporter

Creating a custom app is actually fairly simple to do, it is just a little hard to understand :smileywink:. There is a simple way, and a more complex way. The complex way is a much more useful tool. The simple way is to create a custom app by clicking add in application objects, give it a name and then check the box marked Continue scanning for other Applications. Then click on policies tab and select application override. Click add and name it, give it a source and destination, and the port(s) that it uses, select the custom application that you created and presto you have that unknown-tcp or unknown-upd traffic show in the logs as your custom app.

The more complex method entails actually packet capturing the traffic and creating a signature based on that traffic. The document that sraghunandan, posted:

https://live.paloaltonetworks.com/docs/DOC-2015 does a far better job of explaining that I could. For non-http traffic, I have used unknown-req-tcp-payload, and hex string matches, with defined ports. Just remember the \x at the beginning and the end!

The inherent vice of capitalism is the unequal sharing of blessings; the inherent virtue of socialism is the equal sharing of miseries.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!