Description

This article goes over the use of the pattern-pcre as a troubleshooting step for IDP signatures.

Symptoms

Your IDP config seems to be correct, you have the correct context and the correct pattern for your signature, the signature is applied to the correct IDP and the traffic matches the policy.

You are using "pattern" statement.

Traffic is not matching the signature.

Solution

Change the "pattern" statement to "pattern-pcre", example:

 

From

set security idp custom-attack ATTACK-OBJECT-TEST attack-type signature protocol-binding application HTTP

set security idp custom-attack ATTACK-OBJECT-TEST attack-type signature context http-status

set security idp custom-attack ATTACK-OBJECT-TEST attack-type signature pattern 401

set security idp custom-attack ATTACK-OBJECT-TEST-type signature direction any

 

 

To

set security idp custom-attack ATTACK-OBJECT-TEST attack-type signature protocol-binding application HTTP

set security idp custom-attack ATTACK-OBJECT-TEST attack-type signature context http-status

set security idp custom-attack ATTACK-OBJECT-TEST attack-type signature pattern-pcre 401

set security idp custom-attack ATTACK-OBJECT-TEST-type signature direction any

Modification History

2023-12-13 : Article Created