HTTP DDoS attack block signature

[kdaitadmin225]

I need to know how to create a custom signature to block HTTP DDoS attack signature against our Web server.

The common pattern I can observe in the attack is - either (1) Automated specific URL access  or (2) URL access request with Cache-Control: no-cache\r\n\

I appreciate your comments or suggestions.

Sincerely yours, Mike

[kdd]

Hi Kdaitadmin,

please look here where they discussed http ddos and found a solution.

https://live.paloaltonetworks.com/message/29281#29281

maybe this meets you needs.

Regards Klaus

[kdaitadmin225]

Hi Klaus,

Thank you for your response.

I was looking at exact same post. The post said "Create the custom signature to block HTTP Packets with "Cache-control: no-store, must-revaridate\r\n",

but I just need to know how to create custom signature on our PA-500 box with PANOS 5.0.

If you know how to create a custom HTTP block signature, I much appreciate your support.

Sincerely yours,  Mike

[kdd]

Hi kdaitadmin,

to set up a signature go the objects tab, -> Application and -> Add

chose the parameter which will be shown in the log for this signature

and then go to  the signature tab and choose add to open this menu

assign a signature name and choose the add condition you want

afterwards the menu with http header options appear

assign a pattern and to be more precise choose a qualifier / method. this depends on the context you have choosen before

pattern syntax

https://live.paloaltonetworks.com/docs/DOC-1499

hope this helps

Regards Klaus

[Phoenix]

Hello kdaitadmin225,

Here are couple docs explaining creating of custom signatures for Apps and threats.

Custom Application Signatures

Creating Custom Threat Signatures

Hope this helps.