Forum Discussion

Yogi_377123's avatar
Yogi_377123
Icon for Nimbostratus rankNimbostratus
Nov 26, 2018

ASM Custom attack signature rule

I want to block some specific keywords in my post request like i.e Block through an attack signature. What would be the script for Rule section in attack signature creation page.

 

I have created below script can some one validate this please and correct me where I am wrong.

 

content:"Block";nocase; to search the keyword block

 

uricontent:"POST"; to find the method in request line it should be POST

 

  • Here is v14.1 writing custom attack signatures

    https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/big-ip-asm-attack-and-bot-signatures-14-1-0/04.html

     

    Here is an demo video

    https://www.youtube.com/watch?v=1JsUdHQq3Ug