For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Wasfi_Bounni's avatar
Wasfi_Bounni
Icon for Cirrocumulus rankCirrocumulus
May 11, 2022
Solved

How do I use an or operator for this APM policy expression?

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters"."Domain"="example.F5.com" For the above expression, how can I say that the domain that this registry value equals is example.f...
BIG-IP Access Policy Manager (APM)
security
  • Sebastiansierra's avatar
    Sebastiansierra
    May 11, 2022

    Hi Wasfi,

    I understood your point, but first, you have to store the HKEY_LOCAL_MACHINE from the user in a session variable using the Windows Registry utility and then can use it to compare with the desired HKEY_LOCAL_MACHINE.

    You have more possibilities as make an Adquery to your AD Server and send the domain of the user in a custom variable and compare it with the desired value, allowing the system to determine a different flow based on the domain.

    In my personal experience, I discarded the Windows Registry utility because it doesn´t work in all cases, and only applies to windows devices.

  • Wasfi_Bounni's avatar
    Wasfi_Bounni
    Icon for Cirrocumulus rankCirrocumulus
    May 11, 2022

    Hi Sebastian;

    Thank you for your response. The above link does not help me use an or operator. Basically, I want to write something like:

    "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters"."Domain"="example.F5.com" OR "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters"."Domain"="abc.com"

    So if the value of the registry is example.f5.com or abc.com, then the expression evaluates to "True".

    Kindly

    Wasfi