Help with Bulding Custom Signature

[mohammed.ibrahim]

Can anyone help me with this. I want to build a custom signature for the particular http string to trigger.

http://150.50.15.110/myapp?DATA=01234567890&USER=joe

The objective is whenever the Data attribute value is 11 characters or more it should trigger. Else it should not. Also we have to use RequestRegex only. This is a labops lab but I never got it working even with their solution. When ever I try to match a ? (i.e \?) in the custom signature it does not work. When use a .+ it works.

I used the custom string to get it working

[gG][eE][tT][\x20]/[mM][yY][aA][pP].+DATA=.{11,}\&USER

When ever I replace the .+ with either \? or \?+ or \?] or [\?]+ or (\?) or (\?)+ it does not work. Am I missing something. I have spent more than 40 hrs and at last given up.

I am using 4.1(4)s97 and a 4215. Am I running into a Bug.

[micballa · Accepted solution]

The following regex will fire:

[gG][eE][tT][\x20]/[mM][yY][aA][pP][pP][\?]DATA=.{11,}\&USER

Your regex is missing the second 'P'.

-Jason

[mohammed.ibrahim]

Thanks Jason.

I think it just needed one more person looking at it. :)