About drogers

Brandon,    Yes - in my example 'test' is a custom URL category that I used when I was validating this.  The example I was working out was actually for a customer that required a redirect to a 3rd party web server for quarantining users, but you could just as easily use the script to update the DOM to display a completely different set of text / layout based on the URL category.  Or you could do as your example pointed out and send users to different landing pages on your own web server.  Pretty much anything you can do with javascript can be done in place of the redirect in my script...     ... View more

Regex is done in custom hardware, so it's not just a standard off-the-shelf engine, but for these purposes it's close enough to PCRE.  In fact since you're just doing a string match simply using Automated_Clearing_House_transaction will work. I created and tested a signature with the following config: and it worked on a test url: The XML for the signature is: drogers@Captain.America# show threats vulnerability 42001 signature     <signature>       <standard>         <entry name="ACH">           <and-condition>             <entry name="And Condition 1">               <or-condition>                 <entry name="Or Condition 1">                   <operator>                     <pattern-match>                       <pattern>Automated_Clearing_House_transaction</pattern>                       <context>http-req-uri-path</context>                       <negate>no</negate>                     </pattern-match>                   </operator>                 </entry>               </or-condition>             </entry>           </and-condition>           <order-free>no</order-free>           <scope>protocol-data-unit</scope>         </entry>       </standard>     </signature> ... View more

When you get it working, please share a sanitized version on DevCenter! ... View more

by the way, the insufficient-data log in the screenshot above is from an open bittorrent session that my new rules blocked.  Everything related to pandora fell under the pandora rule, and all other web-browsing and ssl traffic went to the web-browsing rule.  ... View more

Sounds about right - trying to manage Apps with URL categories tied to them is problematic.  I'd take the URL category out of your Pandora rule and just leave the application control to AppID.  ... View more

In general, trying to control applications using URLs is problematic - it tends to work better for blocking apps than for allowing them.  For example, in your particular case, blocking access to the pandora.com URL would obviously prevent users from using those services, but the converse is not true due to fun things like ad networks, CDNs, etc.  (it's not at all uncommon for web2.0 apps to use dozens of URLs from numerous domains).  We generally suggest controlling access to apps such as this via AppID only, as the AppIDs are much more granular and accurate than a single URL ever could be. ... View more