URL Filtering - look only at host not URI

CP-NDA — Wed, 26 Jan 2022 10:08:00 GMT

Hi,

While doing some logs inspection we found that one of our Custom Application (whitelisting) is in the top trafic.

After checking the logs we found that some Web Advertisement are matching this rule to a wrong categorization

URL Whitelist contains:

*.example.com

The logs reported in our report contains this ressource:

https://c.go-mpulse.net/api/config.json?key=XXXX&d=support.example.com&t=XXXX

From my understanding this shoul not trigger a hit ??

I decided to follow this SK174194

Symptoms

The URL partially matches the URL defined in the custom application/Site field

Example:
The custom URL is defined as example.com and matches URL example.commerce.com

Cause

When scanning for the URL, the URL must be closed off with a forward slash: "/", otherwise example.commerce.com will match example.com

Solution

Close the URL string with "/" at the end, for the correct match.
Example of the correct definition: "example.com/"

From my understanding this shoul not trigger a hit ??

After implementing the SK a hit to the following URL is still matching

https://c.go-mpulse.net/api/config.json?key=XXXX&d=support.example.com/test&t=XXXX

What is the correct implementation to only filter:

http(s)://support.example.com/ or http(s)://example.com/ if possible without Regex as HTTPS inspection is not enabled for all profiles

Thank you

Re: URL Filtering - look only at host not URI

PhoneBoy — Wed, 02 Feb 2022 06:15:25 GMT

Without HTTPS Inspection the rest of the URL should be irrelevant.
With HTTP, it might be worth a TAC case to clarify.

topic Re: URL Filtering - look only at host not URI in Firewall and Security Management

URL Filtering - look only at host not URI

Re: URL Filtering - look only at host not URI