Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 

Custom attack signature syntax for multiple user agents

Jonathan_c
Altocumulus
Altocumulus

Hi,

I want to create a custom attack signature that will block requests that contains specific user agents.

I've already created a signature that blocks Python user agent, but I'm not sure how to add multiple ones to the same signature.

Under "Rule" section, I use the Simple Edit Mode and I have set:
Matched Element: Header
Matched Criteria: Matches regular expression
Keyword: User-Agent:.*[Pp]ython.*

How do I add more user agents?

Thanks

1 REPLY 1

JRahm
Community Manager
Community Manager

Hi @Jonathan_c, if you use a regular expression you can match any number of strings and in case-insensitive manner.  You can check out a couple examples for guidance: