|Mailing List email@example.com Archived Message #314||back to list|
In <firstname.lastname@example.org>, on 04/19/21
at 11:18 AM, "Massimo S." <email@example.com> said:
thanks, but it seems is not working
Why would you expect it to?
Ian, FWIW, Massimo is trying to do URL matching, whic does allow
Massimo, that said, you are trying to match a URL to a User-Agent name
which is almost never going to work.
What you need to do is match on the bot name in the User-Agent header.
I recommend you start with a logging rule so you can see what the packet
actually contains. Baring typos, you want:
Comment = "Log HTTP requests for MJ bot",
Destination-Port = "80 443",
Log-Control = Enabled,
Log-Mask = "date time severity message rule source resolved_source prot
Log-Severity = Major,
Hex-String = "<nocase>12bot",
Depth = 200
Rule-Action = Log,
Direction = Incoming
Once you understand the packet you want to match on, you can convert this
into a Deny Rule-Action, tuning the Depth and Log-Mask to optimized the
FWIW, if this were my problem, I would use an observe rule to blacklist
Massimo, is the really the logged URL:
It does not look valid to me. If you edited it, don't do that in the
future. I am only willing to try so hard to help you.
Mail to ListMaster