Custom vulnerability object trigger

[M.Bathgate]

Trying to use a custom vulnerability object to raise a threat alert when a user directly enters a request for access to an IPv4 address . eg http://12.34.56.78  .  Ive created a object , with a pattern of (.*((?:\d{1,3}\.){3}\d{1,3})) and applied it to a vulnerability profile that is applied to a bunch of rules .   I can see the rules triggered but the vulnerability is not logging as a threat , ive also had the converse where a normal URL eg http://www.xyz.com is being flagged as a vulnerability as a false positive .    Anyone had success (consistently) with custom vulnerability objects using regex patterns ?    the field im using the regex pattern against is http-req-host-headers

[aleksandar.astardzhiev]

Hi @M.Bathgate ,

As mentioned here - http-req-host-header Context (paloaltonetworks.com) you may need to specify start and end anchors 

To initiate an exact match search, you must add a <space> before the pattern and ‘\r\n’ after the pattern on PAN-OS 9.1 and earlier. Starting with PAN-OS 10.0 you can use the following anchor characters: ^ and $ to specify a string start and end.

 Also are you applying SSL decryption for this traffic? As you try to check the HTTP host header the firewall will need to decrypt the traffic first.

If not, you may need to use ssl-req-chello-sni (paloaltonetworks.com) for context

[M.Bathgate]

Thanks,  tried those ^ $  wasnt sure if they were working or not at the time, as they seemed to make no difference .  Re SSL , yes decrypted . As a test ive tried test sites under http and https , and again mixed results . Wondering if the policy isnt getting consistently applied for some reason

[aleksandar.astardzhiev]

Hey @M.Bathgate ,

Can you share the full custom vulnerability obect that you have created?

Are you using any Context Qualifiers (paloaltonetworks.com) ?