Using custom URL categories

[JackField]

Hi guys,

We're trying to stop users from accessing webpages featuring 'momo' content.

We've set up the below custom URL category and it only blocks Google searches for momo while in incognito mode, and still allows Google image and Youtube results.  Is there anything wrong with this, we may have gone OTT trying to get this to work:

Using asterisks gives us errors.

Thanks,

J

[BPry]

@JackField ,

You would be better off creating a custom threat signature for something like this instead of a URL category. 

[reaper]

I agree with @BPry , url filtering will limit your scope while a custom threat will be able to inspect payload etc

[JackField]

Hi @reaper , @BPry ,

Thanks for the help.  I've been looking into this and it certainly seems the right path.

I'm running into a brick wall at the moment though.  My Regex's only work with limited effect, and once a search for the malicious term 'momo' has sucessfully established, my vulnerability protections no longer work.  Could you please advise, I've listed them below.

A big part of the problem is that regex's have to be 7 bytes or larger without wildcard objects; so momo on it's own won't work.

Interestingly, one of my Regex's - momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo. - context = http-req-message-body - will block me from working on the custom vulnerability object after it's been commited.  This is a good thing, since it shows the protection is working on websites holding 'momo' content, but it is only working on the firewall config.  I have set up the security profiles and policies correctly, and decryption is enabled.

Here's the regex's that have only limited scope:

Context: http-req-params - Value: search\?q=(.*momo\+.*)

Context: http-req-params - Value: search\?q=(.*.momo.*)

Context: http-req-params - Value: search\?q=(.*.momo*.*)\&source=.

Context: http-req-params - Value: .*(q=momo&rlz=).*

Context: http-req-params - Value: search_query=(.*.momo.*).*

Context: http-req-message-body Value: momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo.

I know it's possible to create a condition that will block any webpage with momo on it, I'm just stumped as to how!

Thanks,

J