Forum Discussion
Mark_22062
Nimbostratus
NimbostratusCustom Signature in ASM
I am trying to create a custom signature that detects a number of Nuisance URLs that are being thrown at our site, but am having a few issues with the syntax of the rule. I've read through the ASM s...
Mark_22062Nimbostratus
NimbostratusHi Ido,
That isn't really practical as the URLs being requested are fairly random but all contain the http keyword or some other keywords we would never use. I had generated an irule that seemed to do the trick but was looking at using ASM to implement instead. The irule I used was in conjunction with a string datagroup.
when HTTP_REQUEST {
set uriclass "MalURI[URI::basename [virtual name]]"
Check that URI is sanitised
set luri [string tolower [HTTP::uri]]
if { [class match $luri contains $uriclass] }
{ HTTP::respond 200 content "Company Name\Naughty Naughty"
log local0. "URI is $luri"
}
}