Manage custom rules

<ips-api-base>/custom_rules

curl -gsvk -X POST -H "$c" --header "Content-Type: multipart/form-data" -F filename=@custom_rule "https://<host>/wsapis/v2.0.0/ips/custom_rules"

Standard WSAPI authentication

POST - add custom rule

File upload sample:

"alert tcp any $HTTP_PORTS -> any any ( msg:
\"Mozilla Firefox Cross Domain Information Disclosure\"; attack_target:client; flow:from_
server; file_data; content:\"alert('Hello '+/^https\\:\\\\/\\\\/twitter.com\\\\/([^/]
+)/.exec(win.locati     on)[1])\"; rule_format:
2; is_ips:yes; action:blockable; vm_verify:no; protocol:http; category:exploit; sub_categ
ory:information_leakage; severity:7; confidence:8; release_date:09-30-2013; modify_date:
01-27-2016;  reference:cve,     CVE-2012-4192; reference:osvdb,OSVDB-86126; metadata:qual
ity null; sid:85000001; rev:12; )",
"alert tcp any $HTTP_PORTS -> any any ( msg:
\"Mozilla Firefox Cross Domain Information Disclosure\"; attack_target:client; flow:from_
server; file_data; content:\"alert('Hello '+/^https\\:\\\\/\\\\/twitter.com\\\\/([^/]
+)/.exec(win.locati     on)[1])\"; rule_format:
2; is_ips:yes; action:blockable; vm_verify:no; protocol:http; category:exploit; sub_categ
ory:information_leakage; severity:7; confidence:8; release_date:09-30-2013; modify_date:
01-27-2016;  reference:cve,     CVE-2012-4192; reference:osvdb,OSVDB-86126; metadata:qual
ity null; sid:85000002; rev:12; )"

JSON upload (application/json)

Json sample:

[
"alert tcp any $HTTP_PORTS -> any any ( msg:\"Mozilla Firefox Cross Domain Information
Disclosure\"; attack_target:client; flow:from_server; file_data; content:\"alert('Hello
'+/^https\\:\\\\/\\\\/twitter.com\\\\/([^/]+)/.exec(win.locati on)[1])\"; rule_format:2;
is_ips:yes; action:blockable; vm_verify:no; protocol:http; category:exploit;
sub_category:information_leakage; severity:7; confidence:8; release_date:09-30-2013;
modify_date:01-27-2016; reference:cve, CVE-2012-4192; reference:osvdb,OSVDB-86126;
metadata:quality null; sid:85000008; rev:12; )"
]

For JSON upload:

The validation results are returned if there are errors (as follows). If no errors, then the Async API response format is returned.

For file upload:

Async API response format is returned.

Sample responses:

[ 
{ 
"valid":true,
"ruleText":"alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:
\"APP-DETECT Absolute Software Computrace outbound connection - search.nam
equery.com2\"; flow:to_server,established; content:\"Host|3A| search.namequ
ery.com3|0D 0A|\"; fast_pattern:only; http_header; content:
\"TagId: \"; http_header; metadata:policy max-detectips drop, policy securityips drop, ruleset community, service http; reference:url,absolute.com/
support/consumer/technology_computrace4; reference:url,attack.mitre.org/
techniques/T10145; reference:url,www.blackhat.com/presentations/bh-usa-09/
ORTEGA/BHUSA09-Ortega-DeactivateRootkit-PAPER.pdf6; classtype:miscactivity; sid:85000000; rev:6;)",
"id":85000000
},
{ 
"valid":false,
"ruleText":"alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS msg:
\"APP-DETECT Absolute Software Computrace outbound connection - search.nam
equery.com7\"; flow:to_server,established; content:\"Host|3A| search.namequ
ery.com8|0D 0A|\"; fast_pattern:only; http_header; content:
\"TagId: \"; http_header; metadata:policy max-detect-
ips drop, policy securityips drop, ruleset community, service http; reference:url,absolute.com/
support/consumer/technology_computrace9; reference:url,attack.mitre.org/
techniques/T101410; reference:url,www.blackhat.com/presentations/bh-usa-09/
ORTEGA/BHUSA09-Ortega-DeactivateRootkit-PAPER.pdf11; classtype:miscactivity; sid:85000001; rev:6;)",
"id":85000001,
"errorMsg":"Optional fields doesn't start with a '('"
}
]