topic Thank you Handy Putra. If I in Cloud Security

Going from Bluecoat to WSA Black/Whitelist Regular Expression Help

tmkgm2013 — Sat, 09 Mar 2019 01:38:43 GMT

In Bluecoat, you can control access by adding an site URL like this 'creditrepairfirm.com/slides/show/' to a custom 'URL Category Object' and have BC either block or allow access to creditrepairfirm.com and it path compont '/slides/show/'

I tryed this on the WSA and it error on the '/slides/show/' so, how can I do this on a WSA?

I don't see how a regular expression works here but, I have to qualify this and say I am not an advance regular expression guy.

Any nudge in the right direction would be appreciated.

Thank you in advance.

Tom

Hi Tom,

Christoph Moormann — Fri, 04 Mar 2016 22:36:10 GMT

Hi Tom,

I haven't tested this but the manual states:

"The Web Security appliance uses a regular expression syntax that differs slightly from the regular expression syntax used by other Velocity pattern-matching engine implementations. Further, the appliance does not support using a backward slash to escape a forward slash. If you need to use a forward slash in a regular expression, simply type the forward slash without a backward slash."

So the "regex" creditrepairfirm.com/slides/show/ should match
http(s)://anything.creditrepairfirm.com/slides/show/anything

would recommend to add "\."

Handy Putra — Wed, 09 Mar 2016 00:51:14 GMT

would recommend to add "\." in front of it so looks like below:

\.creditrepairfirm.com/slides/show/

Therefore will apply to any subdomain of creditrepairfirm.com such as anything.creditrepairfirm.com/slides/show/ (if needed).

Also note, if the destination site is HTTPS and you have HTTPS proxy enabled, you will need to 'decrypt' the traffic first for the appliance to know the links from that domain, else appliance can only see the domain of the destination only (transparent mode, can only see the IP address only instead of domain)

If you do not have HTTPS proxy enable, WSA will only perform CONNECT tunnel to port 443 and will not be able to see the links from that domain such as /slides/show

Thank you Handy Putra. If I

tmkgm2013 — Thu, 10 Mar 2016 20:42:21 GMT

Thank you Handy Putra. If I do put \. does that mean the site has to be tom.creditrepairfirm.com/slide/show/ or will creditrepairfirm.com/slide/show/ work also?

Thank you Christoph Moormann.

tmkgm2013 — Thu, 10 Mar 2016 20:45:12 GMT

Thank you Christoph Moormann. I was expecting something more complacated here. I never just tried creditrepairfirm.com/slides/show/ in the advanced I was trying different combo of regular expression statements instead of the 'easy' approach. .

Hi,

Handy Putra — Thu, 10 Mar 2016 22:21:36 GMT

Hi,

Both "tom.creditrepairfirm.com/slide/show/ " and "creditrepairfirm.com/slide/show/ " will also works if you add \. in front of it.

Re: would recommend to add "\."

Garry Cross — Sat, 09 Dec 2017 00:04:10 GMT

Hi I am trying to understand the regular expression and also just the domain name expression. So in regard to the above correct me if I am wrong but the former expression will match on anything.creditrepairfirm.com but also match on anythingcreditrepairfirm.com. The latter expression will only match if it is actually a subdomain of creditrepairfirm.com.

As for the the second question, focusing just on the sites list what is the significant difference of putting anything.com versus putting .anything.com?