About JackField

Hi @reaper , @BPry ,   Thanks for the help.  I've been looking into this and it certainly seems the right path.   I'm running into a brick wall at the moment though.  My Regex's only work with limited effect, and once a search for the malicious term 'momo' has sucessfully established, my vulnerability protections no longer work.  Could you please advise, I've listed them below.   A big part of the problem is that regex's have to be 7 bytes or larger without wildcard objects; so momo on it's own won't work.   Interestingly, one of my Regex's - momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo. - context = http-req-message-body - will block me from working on the custom vulnerability object after it's been commited.  This is a good thing, since it shows the protection is working on websites holding 'momo' content, but it is only working on the firewall config.  I have set up the security profiles and policies correctly, and decryption is enabled.   Here's the regex's that have only limited scope:   Context: http-req-params - Value: search\?q=(.*momo\+.*) Context: http-req-params - Value: search\?q=(.*.momo.*) Context: http-req-params - Value: search\?q=(.*.momo*.*)\&source=. Context: http-req-params - Value: .*(q=momo&rlz=).* Context: http-req-params - Value: search_query=(.*.momo.*).* Context: http-req-message-body Value: momohoax|momo|momodanger|momowhatsapp|momochallenge|momo.|.momo|.momo.   I know it's possible to create a condition that will block any webpage with momo on it, I'm just stumped as to how!   Thanks, J     ... View more