Cisco CES custom URL blacklist

[nhealey]

I'm trying to create a list of URLs that I would like blocked/quarantined based on a custom list.  For example dropbox urls, but I can't find a way to create a custom list.

I could use a dictionary but I'm not sure that would work as intended.  Anyone have any suggestions?

[dmccabej · Accepted solution]

Hello,

You can use the message body or attachment content filter condition and a dictionary with all of the URLs. You'll want to test to confirm but this should be able to do what you need. 

https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01010.html#con_1127271

Thanks!

-Dennis M.

[nhealey]

Thanks for the suggestion.  I thought about doing it this way but wasn't sure how matching would work, IE. "www. link . com" in my dictionary, would that match "www. link .com/something/something.asp  

But after reviewing your link I now see I can use regex in a dictionary which should solve that issue.  

[dmccabej]

Correct, we utilize the Python flavor of RegEx so you can escape any necessary characters to make sure you match on only what's needed.

Thanks!

-Dennis M.