Hi, i want to create an app signature for our Forcepoint Web Proxy and i have been trying to create the signature but I get the same error:
F-SBID( --name "Forcepoint-Forcepoint.Cloud"; --pattern "webdefence.global.blackspider.com)"; --service HTTP; --service HTTPS --protocol tcp; --protocol udp;)
As an example:
edit "OpenSSL.TLS.Heartbeat.Information.Disclosure-custom.All.20443"
set action block
set comment 'SSL on port 20443'
set signature "F-SBID( --attack_id 4983 \
--name \"OpenSSL.TLS.Heartbeat.Information.Disclosure-custom.All\"; \
--protocol tcp; --src_port 20443; --flow from_server,reversed; \
--pattern \"|18 03|\"; --context packet; --within 2,context; \
--byte_test 2,>,100,1,relative; )"
next
and more in this KB article:
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
