<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>Hi Paolo, <div>Restrict FP with pcre U please. </div><div>Regards </div><div>@Rmkml </div><div><br></div><div><br></div><br><br>-------- Message d'origine --------<br>De : Paolo D'Angeli <paolo.dangeli@asdc.asi.it> <br>Date : 12/01/2016 09:53 (GMT+01:00) <br>À : oisf-users@lists.openinfosecfoundation.org <br>Objet : [Oisf-users] suricata rules for url matching <br><br>I want write custom rule for identify access to specific domain and <br>subdomain (like example.com - example.com/blablabla - <br>subdomain.example.com - subdomain.example.com/blablabla ...).<br><br>I try this:<br><br>alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ACCESS <br>BLOCKED SITE: example.com"; content:"GET"; depth:3; <br>content:"example.com"; http_uri; nocase; threshold: type limit, track <br>by_src, count 1, seconds 300; classtype:policy-violation; sid:600; rev<br>1;)<br><br>It work fine, but match also when I visit url that contain "BLOCKED <br>SITE" like this GOODSITE/index.php?url=example.com<br><br>How can I correct this rule?<br><br>Thanks<br><br>PD<br><br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net</body></html>