Using custom URL categories

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Using custom URL categories

L0 Member

Hi guys,

 

We're trying to stop users from accessing webpages featuring 'momo' content.

 

We've set up the below custom URL category and it only blocks Google searches for momo while in incognito mode, and still allows Google image and Youtube results.  Is there anything wrong with this, we may have gone OTT trying to get this to work:

 

URL category.png

 

Using asterisks gives us errors.

 

Thanks,

J

3 REPLIES 3

Cyber Elite
Cyber Elite

@JackField ,

You would be better off creating a custom threat signature for something like this instead of a URL category. 

I agree with @BPry , url filtering will limit your scope while a custom threat will be able to inspect payload etc

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Hi @reaper , @BPry ,

 

Thanks for the help.  I've been looking into this and it certainly seems the right path.

 

I'm running into a brick wall at the moment though.  My Regex's only work with limited effect, and once a search for the malicious term 'momo' has sucessfully established, my vulnerability protections no longer work.  Could you please advise, I've listed them below.

 

A big part of the problem is that regex's have to be 7 bytes or larger without wildcard objects; so momo on it's own won't work.

 

Interestingly, one of my Regex's - momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo. - context = http-req-message-body - will block me from working on the custom vulnerability object after it's been commited.  This is a good thing, since it shows the protection is working on websites holding 'momo' content, but it is only working on the firewall config.  I have set up the security profiles and policies correctly, and decryption is enabled.

 

Here's the regex's that have only limited scope:

 

Context: http-req-params - Value: search\?q=(.*momo\+.*)

Context: http-req-params - Value: search\?q=(.*.momo.*)

Context: http-req-params - Value: search\?q=(.*.momo*.*)\&source=.

Context: http-req-params - Value: .*(q=momo&rlz=).*

Context: http-req-params - Value: search_query=(.*.momo.*).*

Context: http-req-message-body Value: momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo.

 

I know it's possible to create a condition that will block any webpage with momo on it, I'm just stumped as to how!

 

Thanks,

J

 

 

  • 4416 Views
  • 3 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!