Forum Discussion
jamesdris
Nimbostratus
Nimbostratusmatch regex in payload
iam trying to write a rule to search for a regex for any URL in HTTP::payload, this is what i am using:
when HTTP_REQUEST_DATA {
if { [HTTP::payload] matches_regex {[(https?|ftp):\/\/..]} }
{
HT...
jamesdrisNimbostratus
NimbostratusI am also trying to allow some URLs but block all other URLs in the payload, i think datagroup is not possible as regex can't be used in a datagroup. Is there anyother way to achieve this?
