Imperva Cyber Community

communities_1.jpg
 View Only
  • 1.  Rule with "Dictionary Generic Groups"

    Posted 09-13-2023 22:29
    Edited by Jose Yero 09-13-2023 22:29

    Hi guys.

    I have a web page in which I want a rule that can read any part of this response:
     
    "whitter company-name person-name tamaniowelcome2">Welcome</span>

    Does anyone know how to do it with "Dictionary Generic Groups"?


    #On-PremisesWAF(formerlySecuresphere)




  • 2.  RE: Rule with "Dictionary Generic Groups"

    Posted 09-14-2023 02:51

    Hi Jose,

    Thanks for reaching out to Imperva Community!

     To create an alert that matches the text as-is, please follow these  steps:

    Step 1: Create a New Dictionary

    • Display Name: Anyname
    • Type: Advanced
    • Pattern: Part="whitter company-name person-name tamaniowelcome2"

    This setup should effectively match the text and generate an alert. Give it a try, and let me know if it meets your requirements.

    If you have any more questions or need further assistance, don't hesitate to ask.



    ------------------------------
    Nikhil Nandode
    ------------------------------



  • 3.  RE: Rule with "Dictionary Generic Groups"

    Posted 09-14-2023 12:26
    Edited by Jose Yero 09-14-2023 12:27
    Hello Jose.
     
    Thanks for the reply.
     
    I have configured the new dictionary in this way, however when applying to the rule I see other alerts that do not have that parameter in their response.
    That's how it is in the rule.
    It should be noted that the answers are from a web page. What would I be doing wrong?




    ------------------------------



  • 4.  RE: Rule with "Dictionary Generic Groups"

    Posted 09-15-2023 00:47

    Dear Jose,

    Thanks for the revert,

    could you please provide us with the alert details? Typically, in the alerts section, we can spot the matching text, which would help us understand what's being matched.

    Thanks.



    ------------------------------
    Nikhil Nandode
    ------------------------------