Forum Discussion
Hussein_Ghazy
Nimbostratus
NimbostratusCreate User-Defined Signature for user agents
Hi All,
I want to create a user defined signature that triggers and block after it found the user agent "torrent"
I will create a user defined signature to search the header for "torrent" to trigger an action, will add the below to the user defined signature Rule
headercontent:"torrent";
Is the above Rules will trigger any header with torrent work?
Regards
Hussein
1 Reply
It sounds like you are headed in the right direction with this. Here's an article I wrote that discusses custom ASM signatures. In my case, I used the "content" rule, but it sounds like you are correct in using the "headercontent" rule for your situation. https://devcentral.f5.com/articles/blocking-spam-with-custom-attack-signatures
I hope this helps!
