Forum Discussion

ILIAS_g_183177's avatar
ILIAS_g_183177
Icon for Nimbostratus rankNimbostratus
Sep 20, 2017

ASM blocking mallware

Hello,

 

We would like to know if ASM can analyze the HTTP Header of a request and evaluate the following fields in order to identify potential unwanted traffic:

 

  • Referer
  • X-Requested-With

The “Referer” field indicates the domain that sent the traffic to our site. We would like to block traffic coming from low reputation domains.

 

The “X-Requested-With” field indicates the mobile application package name that sent the traffic to our site. We would like to block traffic coming from applications that are known as infected.

 

is this is supported, can it be created via the policy-builder or via irule script?

 

thank you.

 

ASM Advanced WAF
security
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Sep 21, 2017

    Hi,

     

    With an irule, you can extract and manage both informations. but ASM doesn't use domain reputation and infected application database.

     

    If you can provide both informations (static list) or an URL where BIGIP can download a list of domain and application to block, this can be done with an irule (and a scheduled icall script to download and fulfill datagroups of apps and domains)!