About markeating

markeating · ‎03-14-2013

So after a lot of messing around & finally talking to the righ person, have managed to create the following: A custom app that uses a specific dns name in the signature for identification A custom threat/vulnerability profile using a dns name in the signature for identification In both cases, I can use this new custom signature to allow/block traffic successfully 🙂 It turns out that it's quite simple to do really, and I take no credit for figuring it out as the information is on the Palo Alto site (it just wasn't that easy to find). You need to write the pattern match in hex taken from a Wireshark trace under the dns-req-section context as per the details in this link: I used it last night & had my custom signature working within about 20 minutes of me getting this information.

markeating · ‎03-15-2013

Hi Eric, have a look at the post I updated ()- gives details of exactly how to do this via a custom app/custom threat signature. I've just done this to do the reverse of what you're trying - allow lookups to an entire domain, but block 1 specific dns entry out of the entire domain, so it is possible.

Member Since	‎01-19-2011 01:50 AM
Date Last Visited	‎08-18-2015 09:06 AM
Posts	4
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

About markeating

Re: How to write a custom app signature that allows only a specific DNS query?

Re: Blocking specific DNS lookups via Custom threats - solved!

Re: Blocking specific DNS lookups via Custom threats

Blocking specific DNS lookups via Custom threats - solved!

Re: How to write a custom app signature that allows only a specific DNS query?

Re: Blocking specific DNS lookups via Custom threats - solved!

Re: How to write a custom app signature that allows only a specific DNS query?