09-01-2021 06:40 PM - edited 09-01-2021 06:42 PM
Cool idea! Just like the GitHub code on HTTP response codes for visibility.
This configuration works for Type 8 and Type 0:
tyoung@fdslcofw01# show | match 4400
set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to value 0
set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to context icmp-rsp-code
set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to negate no
set threats vulnerability 44000 signature standard icmp-rsp-code order-free yes
set threats vulnerability 44000 signature standard icmp-rsp-code scope protocol-data-unit
set threats vulnerability 44000 default-action alert
set threats vulnerability 44000 threatname "ICMP Type 0"
set threats vulnerability 44000 severity informational
set threats vulnerability 44000 direction both
set threats vulnerability 44000 affected-host client yes
set threats vulnerability 44000 affected-host server yes
set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match pattern 8
set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match context icmp-req-data
set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match negate no
set threats vulnerability 44008 signature standard icmp-req-data order-free yes
set threats vulnerability 44008 signature standard icmp-req-data scope protocol-data-unit
set threats vulnerability 44008 default-action alert
set threats vulnerability 44008 threatname "ICMP Type 8"
set threats vulnerability 44008 severity informational
set threats vulnerability 44008 direction both
set threats vulnerability 44008 affected-host client yes
set threats vulnerability 44008 affected-host server yes
set profiles vulnerability Internal-VP threat-exception 44008 action default
set profiles vulnerability Internal-VP threat-exception 44008 packet-capture disable
set profiles vulnerability Internal-VP threat-exception 44000 action default
set profiles vulnerability Internal-VP threat-exception 44000 packet-capture disable
[edit]
tyoung@fdslcofw01# exit
Exiting configuration mode
tyoung@fdslcofw01> show bad-custom-signature
bad performance custom signature list:
TID: 44008, Vsys 1, Context: icmp-req-data, Pattern: 8
However, I did get the following commit warning:
Warning: one or more custom signatures have big performance impact.
Please see details in CLI "show bad-custom-signature"
You can see the command output above.
There is one strange behavior. I enabled the signatures in 1 VP, but it logs for all. See step 4 in https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/custom-application-....
