- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-06-2019 06:21 AM
Hi guys,
We're trying to stop users from accessing webpages featuring 'momo' content.
We've set up the below custom URL category and it only blocks Google searches for momo while in incognito mode, and still allows Google image and Youtube results. Is there anything wrong with this, we may have gone OTT trying to get this to work:
Using asterisks gives us errors.
Thanks,
J
03-06-2019 10:25 AM
You would be better off creating a custom threat signature for something like this instead of a URL category.
03-07-2019 04:37 AM
I agree with @BPry , url filtering will limit your scope while a custom threat will be able to inspect payload etc
03-12-2019 03:11 AM
Thanks for the help. I've been looking into this and it certainly seems the right path.
I'm running into a brick wall at the moment though. My Regex's only work with limited effect, and once a search for the malicious term 'momo' has sucessfully established, my vulnerability protections no longer work. Could you please advise, I've listed them below.
A big part of the problem is that regex's have to be 7 bytes or larger without wildcard objects; so momo on it's own won't work.
Interestingly, one of my Regex's - momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo. - context = http-req-message-body - will block me from working on the custom vulnerability object after it's been commited. This is a good thing, since it shows the protection is working on websites holding 'momo' content, but it is only working on the firewall config. I have set up the security profiles and policies correctly, and decryption is enabled.
Here's the regex's that have only limited scope:
Context: http-req-params - Value: search\?q=(.*momo\+.*)
Context: http-req-params - Value: search\?q=(.*.momo.*)
Context: http-req-params - Value: search\?q=(.*.momo*.*)\&source=.
Context: http-req-params - Value: .*(q=momo&rlz=).*
Context: http-req-params - Value: search_query=(.*.momo.*).*
Context: http-req-message-body Value: momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo.
I know it's possible to create a condition that will block any webpage with momo on it, I'm just stumped as to how!
Thanks,
J
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!