API URL
<ips-api-base>/custom_rules
Sample curl request
curl -gsvk -X POST -H "$c" --header "Content-Type: multipart/form-data" -F filename=@custom_rule "https://<host>/wsapis/v2.0.0/ips/custom_rules"
Authentication
Standard WSAPI authentication
Method
POST - add custom rule
Request payload samples
File upload sample:
"alert tcp any $HTTP_PORTS -> any any ( msg:
\"Mozilla Firefox Cross Domain Information Disclosure\"; attack_target:client; flow:from_
server; file_data; content:\"alert('Hello '+/^https\\:\\\\/\\\\/twitter.com\\\\/([^/]
+)/.exec(win.locati on)[1])\"; rule_format:
2; is_ips:yes; action:blockable; vm_verify:no; protocol:http; category:exploit; sub_categ
ory:information_leakage; severity:7; confidence:8; release_date:09-30-2013; modify_date:
01-27-2016; reference:cve, CVE-2012-4192; reference:osvdb,OSVDB-86126; metadata:qual
ity null; sid:85000001; rev:12; )",
"alert tcp any $HTTP_PORTS -> any any ( msg:
\"Mozilla Firefox Cross Domain Information Disclosure\"; attack_target:client; flow:from_
server; file_data; content:\"alert('Hello '+/^https\\:\\\\/\\\\/twitter.com\\\\/([^/]
+)/.exec(win.locati on)[1])\"; rule_format:
2; is_ips:yes; action:blockable; vm_verify:no; protocol:http; category:exploit; sub_categ
ory:information_leakage; severity:7; confidence:8; release_date:09-30-2013; modify_date:
01-27-2016; reference:cve, CVE-2012-4192; reference:osvdb,OSVDB-86126; metadata:qual
ity null; sid:85000002; rev:12; )"JSON upload (application/json)
Json sample:
[
"alert tcp any $HTTP_PORTS -> any any ( msg:\"Mozilla Firefox Cross Domain Information
Disclosure\"; attack_target:client; flow:from_server; file_data; content:\"alert('Hello
'+/^https\\:\\\\/\\\\/twitter.com\\\\/([^/]+)/.exec(win.locati on)[1])\"; rule_format:2;
is_ips:yes; action:blockable; vm_verify:no; protocol:http; category:exploit;
sub_category:information_leakage; severity:7; confidence:8; release_date:09-30-2013;
modify_date:01-27-2016; reference:cve, CVE-2012-4192; reference:osvdb,OSVDB-86126;
metadata:quality null; sid:85000008; rev:12; )"
]Response
For JSON upload:
The validation results are returned if there are errors (as follows). If no errors, then the Async API response format is returned.
For file upload:
Async API response format is returned.
Sample responses:
[
{
"valid":true,
"ruleText":"alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:
\"APP-DETECT Absolute Software Computrace outbound connection - search.nam
equery.com2\"; flow:to_server,established; content:\"Host|3A| search.namequ
ery.com3|0D 0A|\"; fast_pattern:only; http_header; content:
\"TagId: \"; http_header; metadata:policy max-detectips drop, policy securityips drop, ruleset community, service http; reference:url,absolute.com/
support/consumer/technology_computrace4; reference:url,attack.mitre.org/
techniques/T10145; reference:url,www.blackhat.com/presentations/bh-usa-09/
ORTEGA/BHUSA09-Ortega-DeactivateRootkit-PAPER.pdf6; classtype:miscactivity; sid:85000000; rev:6;)",
"id":85000000
},
{
"valid":false,
"ruleText":"alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS msg:
\"APP-DETECT Absolute Software Computrace outbound connection - search.nam
equery.com7\"; flow:to_server,established; content:\"Host|3A| search.namequ
ery.com8|0D 0A|\"; fast_pattern:only; http_header; content:
\"TagId: \"; http_header; metadata:policy max-detect-
ips drop, policy securityips drop, ruleset community, service http; reference:url,absolute.com/
support/consumer/technology_computrace9; reference:url,attack.mitre.org/
techniques/T101410; reference:url,www.blackhat.com/presentations/bh-usa-09/
ORTEGA/BHUSA09-Ortega-DeactivateRootkit-PAPER.pdf11; classtype:miscactivity; sid:85000001; rev:6;)",
"id":85000001,
"errorMsg":"Optional fields doesn't start with a '('"
}
]