URL expression

[oitspa]

please, how to write url expression if I want to block all domains including some word e.g.xxxx.

exapl blocked domain nicexxxxday.***

[BCH]

Hi, use a custom URL category to achieve this

"Objects" tab, > "Custom URL Category" to create it.

You can match entire domains or use wildcards if you need.

[oitspa]

I need wildcard but dont know how to write it for this case - looking for a word somewhere inside the domain

Thank you for help

[BCH]

Well in this case you can create a custom application signature with a simple regex containing any words you like.

For example, you can match the context "http-req-host-header" with the required regex to filter on domain names.

Please also have a look at https://live.paloaltonetworks.com/docs/DOC-1499 if it can help you.

[oitspa]

I tried to create signature butI cannot commit it because word is shorter than 7 letters. Is there any workaround?

[BCH]

Yes, the match engine requires at least 7 consecutive bytes for filters.

What does your filter look like at the moment ?

[oitspa]

at this moment I only try to solve requirement, I created test rule with signature as you propose. In pattern field I wrote .*(xxxxxx)

(xxxxxx is word I have to block in all web requests)

[oitspa]

any idea, how to solve it?

many thanks

[BCH]

As explained by Mikand here : https://live.paloaltonetworks.com/message/25100#25100

You can add wildcards at the beginning and/or the end of an expression to get past the 7-bytes limitation

[oitspa]

hmm, I tried to type .*xxxxxx.* into the field pattern but again - Operation failed

-> signature -> test -> and-condition -> And Condition 1 -> or-condition -> Or Condition 5 -> operator -> pattern-match -> pattern '.*xxxxxx.*' is invalid. pattern must be at least 7 bytes