4259 lines
113 KiB
JSON
4259 lines
113 KiB
JSON
{
|
||
"rule_table": "RULE_DEFAULT",
|
||
"object2object_table": "OBJECT2OBJECT",
|
||
"objects": [
|
||
{
|
||
"object_name": "ASN1234",
|
||
"uuid": "00000000-0000-0000-0000-000000000001",
|
||
"items": [
|
||
{
|
||
"table_name": "AS_NUMBER",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "^AS1234$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ASN2345",
|
||
"uuid": "00000000-0000-0000-0000-000000000002",
|
||
"items": [
|
||
{
|
||
"table_name": "AS_NUMBER",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "^AS2345$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ASN6789",
|
||
"uuid": "00000000-0000-0000-0000-000000000003",
|
||
"items": [
|
||
{
|
||
"table_name": "AS_NUMBER",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "^AS6789$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ASN9001",
|
||
"uuid": "00000000-0000-0000-0000-000000000004",
|
||
"items": [
|
||
{
|
||
"table_name": "AS_NUMBER",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "^AS9001$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ASN9002",
|
||
"uuid": "00000000-0000-0000-0000-000000000005",
|
||
"items": [
|
||
{
|
||
"table_name": "AS_NUMBER",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "^AS9002$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ASN9003",
|
||
"uuid": "00000000-0000-0000-0000-000000000006",
|
||
"items": [
|
||
{
|
||
"table_name": "AS_NUMBER",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "^AS9003$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "IPv4-composition-source-only",
|
||
"uuid": "00000000-0000-0000-0000-000000000007",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "192.168.50.24"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "FQDN_OBJ1",
|
||
"uuid": "00000000-0000-0000-0000-000000000008",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "^sports.example.com$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "FQDN_CAT1",
|
||
"uuid": "00000000-0000-0000-0000-000000000009",
|
||
"items": [
|
||
{
|
||
"table_name": "INTERGER_PLUS",
|
||
"table_type": "interval",
|
||
"table_content": {
|
||
|
||
"interval": "1724"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "IPv4-composition-NOT-client-ip",
|
||
"uuid": "00000000-0000-0000-0000-000000000010",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "192.168.58.19"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "IPv4-composition-NOT-server-ip",
|
||
"uuid": "00000000-0000-0000-0000-000000000011",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "10.0.1.20-10.0.1.25"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "financial-department-ip",
|
||
"uuid": "00000000-0000-0000-0000-000000000012",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "192.168.40.88/32"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "security-department-ip",
|
||
"uuid": "00000000-0000-0000-0000-000000000013",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "192.168.40.88/32"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "develop-department-ip",
|
||
"uuid": "00000000-0000-0000-0000-000000000014",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "192.168.40.88/32"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "Country-Sparta-IP",
|
||
"uuid": "00000000-0000-0000-0000-000000000015",
|
||
"items": [
|
||
{
|
||
"table_name": "GeoLocation",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "^Greece.Sparta$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "123_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000100",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "10.0.6.201/32"
|
||
}
|
||
},
|
||
{
|
||
"table_name": "IP_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "2001:da8:205:1::101/112"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "126_interval_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000106",
|
||
"items": [
|
||
{
|
||
"table_name": "CONTENT_SIZE",
|
||
"table_type": "interval",
|
||
"table_content": {
|
||
"interval": "2014-2016"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "TakeMeHome",
|
||
"uuid": "00000000-0000-0000-0000-000000000111",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "Take me Home&Batman\\",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "152_mail_addr",
|
||
"uuid": "00000000-0000-0000-0000-000000000141",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "MAIL_ADDR",
|
||
"table_content": {
|
||
"expression": "^ceshi3@mailhost.cn",
|
||
"expr_type": "and"
|
||
}
|
||
},
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "MAIL_ADDR",
|
||
"table_content": {
|
||
"expression": "^ceshi6@mailhost.cn",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "153_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000143",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "MAIL_ADDR",
|
||
"table_content": {
|
||
"expression": "^ceshi4@mailhost.cn",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "vt_grp_http_sig1",
|
||
"uuid": "00000000-0000-0000-0000-000000000152",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_SIGNATURE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
|
||
"expression": "Chrome/78.0.3904.108",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "167_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000158",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "2019/12/27",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject199_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000189",
|
||
"is_exclude": 0,
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-contained-string-of-rule-199",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject199_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000190",
|
||
"is_exclude": 1,
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-not-contained-string-of-rule-199",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject200_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000192",
|
||
"is_exclude": 0,
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-contained-string-of-rule-200",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject200_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000193",
|
||
"is_exclude": 1,
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-not-contained-string-of-rule-200",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject202_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000195",
|
||
"is_exclude": 0,
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "100.64.1.0-100.64.1.20"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject202_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000196",
|
||
"is_exclude": 1,
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "100.64.1.6-100.64.1.10"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject202_3",
|
||
"uuid": "00000000-0000-0000-0000-000000000197",
|
||
"is_exclude": 1,
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "100.64.1.11-100.64.1.20"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject203_3_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000201",
|
||
"is_exclude": 0,
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "jianshu.com$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject203_3_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000202",
|
||
"is_exclude": 1,
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "^www.jianshu.com$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject204_3_1_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000207",
|
||
"is_exclude": 0,
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "baidu.com$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject204_3_1_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000208",
|
||
"is_exclude": 1,
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "^www.baidu.com$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject204_3_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000209",
|
||
"is_exclude": 1,
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "^mail.baidu.com$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject217_1_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000223",
|
||
"is_exclude": 0,
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "string-of-rule-217.com$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"object_name": "ExcludeLogicObject217_1_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000224",
|
||
"is_exclude": 1,
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "www.string-of-rule-217.com",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"object_groups": [
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000500",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000106"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000501",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000141"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000502",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000100"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000503",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000189"
|
||
],
|
||
"excluded_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000190"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000504",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000192"
|
||
],
|
||
"excluded_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000193"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000505",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000195"
|
||
],
|
||
"excluded_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000196",
|
||
"00000000-0000-0000-0000-000000000197"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000506",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000201"
|
||
],
|
||
"excluded_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000202"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000507",
|
||
"object_name": "ExcludeLogicObject204_3_1",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000207"
|
||
],
|
||
"excluded_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000208"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000508",
|
||
"object_name": "ExcludeLogicObject204_3",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000507"
|
||
],
|
||
"excluded_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000209"
|
||
]
|
||
},
|
||
{
|
||
"object_uuid": "00000000-0000-0000-0000-000000000509",
|
||
"included_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000223"
|
||
],
|
||
"excluded_sub_object_uuids": [
|
||
"00000000-0000-0000-0000-000000000224"
|
||
]
|
||
}
|
||
],
|
||
"rules": [
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000123",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "escaped\\bdata:have\\ba\\bspace\\band\\ba\\b\\&\\bsymbol.",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_CONFIG",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000100"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "123_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000101",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "abckkk&123",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000124",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_CONFIG",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000100"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "CONTENT_SIZE",
|
||
"objects": [
|
||
{
|
||
"object_name": "124_interval_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000102",
|
||
"items": [
|
||
{
|
||
"table_name": "CONTENT_SIZE",
|
||
"table_type": "interval",
|
||
"table_content": {
|
||
"interval": "100-500"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000125",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "125_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000103",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "action=search\\&query=(.*)",
|
||
"expr_type": "regex"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000126",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "126_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000105",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "should_not_hit_any_rule",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "CONTENT_SIZE",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000106"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000128",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "StringScan.ExprPlus",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_SIGNATURE",
|
||
"objects": [
|
||
{
|
||
"object_name": "128_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000107",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_SIGNATURE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
|
||
"expression": "abckkk&123",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000129",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "utf8_中文",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "129_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000108",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "C#中国",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000130",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "utf8_维语",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "130_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000109",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "2010&يىلىدىكى",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000131",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "utf8_维语2",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "131_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000110",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "سىياسىي",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000132",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "string\\bunescape",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"object_name": "TakeMeHome",
|
||
"object_uuid": "00000000-0000-0000-0000-000000000111"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000133",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "13018_table_conjunction_test_part1\bnow_its_very_very_long0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "133_host_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000112",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_HOST",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "www.3300av.com",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000134",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "table_conjunction_test_part2",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "134_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000113",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "novel&27122.txt",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000136",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"effective_range":{},
|
||
"action_parameter": "offset_string",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IMAGE_FP",
|
||
"objects": [
|
||
{
|
||
"object_name": "136_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000114",
|
||
"items": [
|
||
{
|
||
"table_name": "IMAGE_FP",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "(offset=4362,depth=4458)|323031333A30333A30372032333A35363A313000323031333A30333A30372032333A35363A3130000000FFE20C584943435F50524F46494C4500010100000C484C696E6F021000006D6E74725247422058595A2007CE00020009000600310000|",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000137",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"effective_range":{},
|
||
"action_parameter": "offset_string",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IMAGE_FP",
|
||
"objects": [
|
||
{
|
||
"object_name": "137_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000115",
|
||
"items": [
|
||
{
|
||
"table_name": "IMAGE_FP",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "(offset=19339,depth=19467)|6CB2CB2F2028474C994991CCFC65CCA5E3B6FF001673985D157358610CACC674EE64CC27B5721CCDABD9CCA7C8E9F7BB1F54A930A6034D50F92711F5B2DACCB0715D2E6873CE5CE431DC701A194C260E9DB78CC89F2C84745869AB88349A3AE0412AB59D9ABA84EDEFFF0057FA4DA66D333698B5AD6F844DA2226D1CADAD5E44|",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000138",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"effective_range": {"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里","上海/浦东/陆家嘴"]},{"tag":"isp","value":["电信","联通"]}],[{"tag":"location","value":["北京"]},{"tag":"isp","value":["联通"]}]]},
|
||
"action_parameter": "Not\\baccepted\\btags",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "138_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000116",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "should&hit&aaa",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000139",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"effective_range": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}",
|
||
"action_parameter": "Accepted\\btags",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "139_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000117",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "should&hit&bbb",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000140",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "file_streams",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "140_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000118",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "2018-10-05",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000141",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "Something:I\\bhave\\ba\\bname,7799",
|
||
"rule_table_name": "RULE_ALIAS",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"o2r_table_name": "OBJECT2RULE_ALIAS",
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "141_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000119",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "i.ytimg.com",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000142",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "StringScan.UTF8EncodedURL",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "142_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000120",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": ",IgpwcjA0LnN2bzAzKgkxMjcuMC4wLjE",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000143",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.OneRegion",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "143_url_object1",
|
||
"uuid": "00000000-0000-0000-0000-000000000121",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-contained-string-of-rule-143",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": true,
|
||
"objects": [
|
||
{
|
||
"object_name": "143_url_object2",
|
||
"uuid": "00000000-0000-0000-0000-000000000122",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-not-contained-string-of-rule-143",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000144",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.ScanNotAtLast",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "144_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000123",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-contained-string-of-rule-144",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"negate_option": true,
|
||
"objects": [
|
||
{
|
||
"object_name": "144_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000124",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-not-contained-string-of-rule-144",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000145",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.ScanNotIP",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "145_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000125",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-contained-string-of-rule-145",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "ATTRIBUTE_IP_CONFIG",
|
||
"negate_option": true,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000100"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000146",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.NotExprConditionAndNotIPCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": false,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "146_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000126",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-contained-string-of-rule-146",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"negate_option": true,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "146_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000127",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-contained-not-string-of-rule-146",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "ATTRIBUTE_IP_CONFIG",
|
||
"negate_option": true,
|
||
"condition_index": 2,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000100"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000147",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.8NotCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS_1",
|
||
"negate_option": true,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "147_keywords_object1",
|
||
"uuid": "00000000-0000-0000-0000-000000000128",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "condition0-in-rule-147",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS_2",
|
||
"negate_option": true,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "147_keywords_object2",
|
||
"uuid": "00000000-0000-0000-0000-000000000129",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "condition1-in-rule-147",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS_3",
|
||
"negate_option": true,
|
||
"condition_index": 2,
|
||
"objects": [
|
||
{
|
||
"object_name": "147_keywords_object3",
|
||
"uuid": "00000000-0000-0000-0000-000000000130",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "condition2-in-rule-147",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS_4",
|
||
"negate_option": true,
|
||
"condition_index": 3,
|
||
"objects": [
|
||
{
|
||
"object_name": "147_keywords_object4",
|
||
"uuid": "00000000-0000-0000-0000-000000000131",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "condition3-in-rule-147",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS_5",
|
||
"negate_option": true,
|
||
"condition_index": 4,
|
||
"objects": [
|
||
{
|
||
"object_name": "147_keywords_object5",
|
||
"uuid": "00000000-0000-0000-0000-000000000132",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "condition4-in-rule-147",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS_6",
|
||
"negate_option": true,
|
||
"condition_index": 5,
|
||
"objects": [
|
||
{
|
||
"object_name": "147_keywords_object6",
|
||
"uuid": "00000000-0000-0000-0000-000000000133",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "condition5-in-rule-147",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS_7",
|
||
"negate_option": true,
|
||
"condition_index": 6,
|
||
"objects": [
|
||
{
|
||
"object_name": "147_keywords_object7",
|
||
"uuid": "00000000-0000-0000-0000-000000000134",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "condition6-in-rule-147",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS_8",
|
||
"negate_option": true,
|
||
"condition_index": 7,
|
||
"objects": [
|
||
{
|
||
"object_name": "147_keywords_object8",
|
||
"uuid": "00000000-0000-0000-0000-000000000135",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "condition7-in-rule-147",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000148",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "StringScan.Regex",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "148_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000136",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "Cookie:\\s.*head",
|
||
"expr_type": "regex"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000150",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "StringScan.BugReport20190325",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "TROJAN_PAYLOAD",
|
||
"objects": [
|
||
{
|
||
"object_name": "billgates_regist1",
|
||
"uuid": "00000000-0000-0000-0000-000000000138",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "TROJAN_PAYLOAD",
|
||
"table_content": {
|
||
"expression": "(offset=0,depth=4)|01000000|",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "TROJAN_PAYLOAD",
|
||
"objects": [
|
||
{
|
||
"object_name": "billgates_regist2",
|
||
"uuid": "00000000-0000-0000-0000-000000000139",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "TROJAN_PAYLOAD",
|
||
"table_content": {
|
||
"expression": "1:G2.40",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000151",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "StringScan.PrefixAndSuffix",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "MAIL_ADDR",
|
||
"objects": [
|
||
{
|
||
"object_name": "151_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000140",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "MAIL_ADDR",
|
||
"table_content": {
|
||
"expression": "ceshi3@mailhost.cn$",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000152",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "StringScan.PrefixAndSuffix",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "MAIL_ADDR",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000141"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "CONTENT_SIZE",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000500"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000153",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "Policy.SubObject",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "MAIL_ADDR",
|
||
"negate_option": false,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000143",
|
||
"00000000-0000-0000-0000-000000000501"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "IP_CONFIG",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000502"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000154",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "ipv4_plus",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "154_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000145",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "10.0.7.100-10.0.7.101"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000155",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "ipv6_plus",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "155_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000146",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "1001:da8:205:1::101-1001:da8:205:1::102"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000157",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "StringScan.StreamScanUTF8",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "TROJAN_PAYLOAD",
|
||
"objects": [
|
||
{
|
||
"object_name": "157_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000148",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "TROJAN_PAYLOAD",
|
||
"table_content": {
|
||
"expression": "我的订单",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000158",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "IPScan.IPv4_CIDR",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "158_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000149",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "192.168.0.1/32"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000159",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "IPScan.IPv6_CIDR",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "159_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000150",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "2001:db8::/120"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000160",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "AttributeWithOnePhysical",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"negate_option": false,
|
||
"object_uuids":[
|
||
"00000000-0000-0000-0000-000000000111"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "160_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000151",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "https://blog.csdn.net/littlefang/article/details/8213058",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000163",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "OneObjectInTwoAttribute",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_REQUEST_HEADER",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "vt_grp_http_sig2",
|
||
"uuid": "00000000-0000-0000-0000-000000000153",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_SIGNATURE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
|
||
"expression": "uid=12345678",
|
||
"expr_type": "and"
|
||
}
|
||
},
|
||
{
|
||
"table_name": "HTTP_SIGNATURE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
|
||
"expression": "sessionid=888888",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_HEADER",
|
||
"negate_option": false,
|
||
"object_name": "vt_grp_http_sig2"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000164",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "CharsetWindows1251",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "164_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000154",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": ">ЗАО «Севергазвтоматика АйС»<",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000165",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "EvaluationOrder",
|
||
"is_valid": "yes",
|
||
"evaluation_order": "2.111",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "165_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000155",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "cavemancircus.com/",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "165_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000156",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "192.168.23.1/24"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000166",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "EvaluationOrder",
|
||
"is_valid": "yes",
|
||
"evaluation_order": "100.233",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "166_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000157",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "2019/12/27/pretty-girls-6",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000167",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "EvaluationOrder",
|
||
"is_valid": "yes",
|
||
"evaluation_order": "300.999",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"condition_index": 1,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000158"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000158"
|
||
],
|
||
"condition_index": 3
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000168",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "EvaluationOrder",
|
||
"is_valid": "yes",
|
||
"evaluation_order": "0",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000158"
|
||
],
|
||
"condition_index": 2
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000158"
|
||
],
|
||
"condition_index": 6
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000169",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "IPScan.IPv4_Any",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"condition_index": 0,
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "169_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000160",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "100.64.3.1/32"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000170",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "IPScan.IPv4_attribute_name.source",
|
||
"is_valid": "no",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "ipv4_attribute_name.source",
|
||
"uuid": "00000000-0000-0000-0000-000000000161",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "192.168.40.10/32"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000171",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "IPScan.IPv4_attribute_name.destination",
|
||
"is_valid": "no",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "ipv4_attribute_name.destination",
|
||
"uuid": "00000000-0000-0000-0000-000000000162",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "192.168.231.46/32"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000177",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.Multiand_conditionsInOneNotCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "ASN_NOT_LOGIC",
|
||
"negate_option": true,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000001",
|
||
"00000000-0000-0000-0000-000000000003",
|
||
"00000000-0000-0000-0000-000000000004"
|
||
],
|
||
"condition_index": 0
|
||
},
|
||
{
|
||
"attribute_name": "DESTINATION_IP_ASN",
|
||
"negate_option": false,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000002"
|
||
],
|
||
"condition_index": 1
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000178",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "Hierarchy.MultiObjectInOneCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "SOURCE_IP_ASN",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000001",
|
||
"00000000-0000-0000-0000-000000000003",
|
||
"00000000-0000-0000-0000-000000000004"
|
||
],
|
||
"negate_option": false,
|
||
"condition_index": 0
|
||
},
|
||
{
|
||
"attribute_name": "DESTINATION_IP_ASN",
|
||
"negate_option": false,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000002"
|
||
],
|
||
"condition_index": 1
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000180",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "Hierarchy.MultiObjectInOneCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"negate_option": false,
|
||
"or_conditions":[
|
||
{
|
||
"attribute_name": "SOURCE_IP_ASN",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000001",
|
||
"00000000-0000-0000-0000-000000000003",
|
||
"00000000-0000-0000-0000-000000000004"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "SOURCE_IP_GEO",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000015"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "IP_CONFIG",
|
||
"negate_option": false,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000012"
|
||
],
|
||
"condition_index": 1
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000181",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.MultiLiteralsInOneNotCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"negate_option": true,
|
||
"or_conditions": [
|
||
{
|
||
"attribute_name": "SOURCE_IP_ASN",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000001",
|
||
"00000000-0000-0000-0000-000000000003",
|
||
"00000000-0000-0000-0000-000000000004"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": true,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000014"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "SOURCE_IP_GEO",
|
||
"negate_option": false,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000015"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000182",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "8-expr",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "182_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000167",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "string1&string2&string3&string4&string5&string6&string7&string8",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000184",
|
||
"action_parameter": "APP_ID=6006740;Liumengyan-Bugreport-20210515",
|
||
"description": "Hulu",
|
||
"is_valid": "yes",
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action": 0,
|
||
"service": 0,
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "184_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000169",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "::/128"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000185",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.SameAttributeInMultiCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"negate_option": true,
|
||
"or_conditions": [
|
||
{
|
||
"attribute_name": "DESTINATION_IP_ASN",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000001",
|
||
"00000000-0000-0000-0000-000000000003",
|
||
"00000000-0000-0000-0000-000000000004"
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "SOURCE_IP_GEO",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000015"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "DESTINATION_IP_ASN",
|
||
"negate_option": true,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000005"
|
||
],
|
||
"condition_index": 1
|
||
},
|
||
{
|
||
"attribute_name": "DESTINATION_IP_ASN",
|
||
"negate_option": false,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000006"
|
||
],
|
||
"condition_index": 2
|
||
},
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000013"
|
||
],
|
||
"condition_index": 3
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000186",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.ScanHitAtLast",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": true,
|
||
"objects": [
|
||
{
|
||
"object_name": "186_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000170",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-not-contained-string-of-rule-186",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "186_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000171",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "10.0.8.186"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000187",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.ScanHitAtLast",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": true,
|
||
"objects": [
|
||
{
|
||
"object_name": "187_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000172",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-not-contained-string-of-rule-187",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "187_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000173",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "10.0.8.187"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000188",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NOTLogic.ScanHitAtLast",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": true,
|
||
"objects": [
|
||
{
|
||
"object_name": "188_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000174",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "must-not-contained-string-of-rule-188",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "188_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000175",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "10.0.8.188"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000189",
|
||
"is_valid": "yes",
|
||
"do_log": 0,
|
||
"action": 0,
|
||
"service": 0,
|
||
"do_blacklist": 0,
|
||
"action_parameter": "StringScan.ShouldNotHitExprPlus",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "APP_PAYLOAD",
|
||
"objects": [
|
||
{
|
||
"object_name": "189_app_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000176",
|
||
"items": [
|
||
{
|
||
"table_name": "APP_PAYLOAD",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
|
||
"expression": "|ab00|",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000191",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "StringScan.HexBinCaseSensitive",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "191_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000178",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "|54455354|",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000192",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "FLAG_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "192_flag_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000179",
|
||
"items": [
|
||
{
|
||
"table_type": "flag",
|
||
"table_name": "FLAG_CONFIG",
|
||
"table_content": {
|
||
"flag": 1,
|
||
"mask": 3
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000193",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "FLAG_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "193_flag_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000180",
|
||
"items": [
|
||
{
|
||
"table_type": "flag",
|
||
"table_name": "FLAG_CONFIG",
|
||
"table_content": {
|
||
"flag": 2,
|
||
"mask": 3
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "193_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000181",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "hello",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000194",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "FLAG_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "194_flag_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000182",
|
||
"items": [
|
||
{
|
||
"table_type": "flag",
|
||
"table_name": "FLAG_CONFIG",
|
||
"table_content": {
|
||
"flag": 21,
|
||
"mask": 31
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000197",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "Something:I\\bhave\\ba\\bname,8866",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "197_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000186",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "hqdefault.jpg",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000198",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "Something:I have a name,7799",
|
||
"rule_table_name": "RULE_FIREWALL_DEFAULT",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"o2r_table_name": "OBJECT2RULE_FIREWALL",
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "198_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000187",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "firewall",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000199",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "ExcludeLogic.ScanNotAtLast",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"object_name": "ExcludeLogicObject199",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000503"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000200",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "ExcludeLogic.OneRegion",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000504"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000202",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "null",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "ATTRIBUTE_IP_PLUS_TABLE",
|
||
"object_name": "ExcludeLogicObject202",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000505"
|
||
],
|
||
"condition_index": 0
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000203",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "null",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "ATTRIBUTE_IP_PLUS_SOURCE",
|
||
"objects": [
|
||
{
|
||
"object_name": "ExcludeLogicObject203_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000198",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "192.168.50.43-192.168.50.43"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "ATTRIBUTE_IP_PLUS_DESTINATION",
|
||
"objects": [
|
||
{
|
||
"object_name": "ExcludeLogicObject203_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000199",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "47.92.108.93-47.92.108.93"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"object_name": "ExcludeLogicObject203_3",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000506"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000204",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "null",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "ATTRIBUTE_IP_PLUS_SOURCE",
|
||
"objects": [
|
||
{
|
||
"object_name": "ExcludeLogicObject204_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000203",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "100.64.2.0-100.64.2.5"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "ATTRIBUTE_IP_PLUS_DESTINATION",
|
||
"objects": [
|
||
{
|
||
"object_name": "ExcludeLogicObject204_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000204",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "100.64.2.6-100.64.2.10"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000508"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000205",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "StringScan.RegexExpressionIllegal",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "205_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000210",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "123^456",
|
||
"expr_type": "regex"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000206",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "duplicateRuleFor191",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "206_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000211",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "|54455354|",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000207",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "duplicateRuleFor192",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "FLAG_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "207_flag_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000212",
|
||
"items": [
|
||
{
|
||
"table_type": "flag",
|
||
"table_name": "FLAG_CONFIG",
|
||
"table_content": {
|
||
"flag": 1,
|
||
"mask": 3
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000208",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "duplicateRuleFor154",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "208_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000213",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "10.0.7.100-10.0.7.106"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000210",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "ipv6_::",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "210_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000215",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "::/0"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000211",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "ip_perf_test",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PERF_CONFIG",
|
||
"negate_option": false,
|
||
"objects": [
|
||
{
|
||
"object_name": "211_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000216",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PERF_CONFIG",
|
||
"table_content": {
|
||
"ip": "10.0.0.1-10.0.0.6"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000212",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "integer_perf_test",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "INTEGER_PERF_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "212_interval_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000217",
|
||
"items": [
|
||
{
|
||
"table_name": "INTEGER_PERF_CONFIG",
|
||
"table_type": "interval",
|
||
"table_content": {
|
||
"interval": "3000"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000213",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "expr_perf_test",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "EXPR_LITERAL_PERF_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "213_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000218",
|
||
"items": [
|
||
{
|
||
"table_name": "EXPR_LITERAL_PERF_CONFIG",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "today&yesterday",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000214",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "flag_perf_test",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "FLAG_PERF_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "214_flag_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000219",
|
||
"items": [
|
||
{
|
||
"table_type": "flag",
|
||
"table_name": "FLAG_PERF_CONFIG",
|
||
"table_content": {
|
||
"flag": 15,
|
||
"mask": 15
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000215",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "expr_perf_test",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "EXPR_REGEX_PERF_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "215_expr_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000220",
|
||
"items": [
|
||
{
|
||
"table_name": "EXPR_REGEX_PERF_CONFIG",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "action=search\\&query=(.*)",
|
||
"expr_type": "regex"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000216",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "NOTCondition&ExcludeObject",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": false,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000504"
|
||
],
|
||
"condition_index": 0
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"negate_option": true,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject216",
|
||
"uuid": "00000000-0000-0000-0000-000000000221",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-for-rule-211",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000217",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "NOTCondition&ExcludeObject",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL_FILTER",
|
||
"negate_option": true,
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000509"
|
||
],
|
||
"condition_index": 0
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"negate_option": false,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject217_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000225",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-for-rule-217",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000218",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "CONTENT_SIZE",
|
||
"objects": [
|
||
{
|
||
"object_name": "218_interval_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000226",
|
||
"items": [
|
||
{
|
||
"table_name": "CONTENT_SIZE",
|
||
"table_type": "interval",
|
||
"table_content": {
|
||
"interval": "3000"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000219",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": false,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject219_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000227",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-219-1",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject219_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000228",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-219-2",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 2,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject219_3",
|
||
"uuid": "00000000-0000-0000-0000-000000000229",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-219-3",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 3,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject219_4",
|
||
"uuid": "00000000-0000-0000-0000-000000000230",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-219-4",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 4,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject219_5",
|
||
"uuid": "00000000-0000-0000-0000-000000000231",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-219-5",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 5,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject219_6",
|
||
"uuid": "00000000-0000-0000-0000-000000000232",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-219-6",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 6,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject219_7",
|
||
"uuid": "00000000-0000-0000-0000-000000000233",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-219-7",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 7,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject219_8",
|
||
"uuid": "00000000-0000-0000-0000-000000000234",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-219-8",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000220",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "anything",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": false,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject220_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000235",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-220-1",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject220_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000236",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-220-2",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_DUMMY",
|
||
"negate_option": true,
|
||
"condition_index": 2,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTConditionAndExcludeObject220_3",
|
||
"uuid": "00000000-0000-0000-0000-000000000237",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "keywords-dummy-220-3",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000222",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "NOTLogic.SingleNotCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_NOT_LOGIC_1",
|
||
"negate_option": true,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTLogicObject_222",
|
||
"uuid": "00000000-0000-0000-0000-000000000240",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "not_logic_keywords_222",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000223",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "NOTLogic.MultiNotCondition",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_NOT_LOGIC",
|
||
"negate_option": true,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTLogicObject_223_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000241",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "not_logic_rule_223_1",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_NOT_LOGIC",
|
||
"negate_option": true,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTLogicObject_223_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000242",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "not_logic_rule_223_2",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_NOT_LOGIC",
|
||
"negate_option": true,
|
||
"condition_index": 2,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTLogicObject_223_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000243",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "not_logic_rule_223_3",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000224",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "NOTLogic.NotPhysicalTable",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"negate_option": true,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTLogicObject_224_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000244",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "not_logic_rule_224_1",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"negate_option": false,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "NOTLogicObject_224_2",
|
||
"uuid": "00000000-0000-0000-0000-000000000245",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "not_logic_rule_224_2",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000225",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "Payload escape",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"negate_option": false,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "EscapeObject_225_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000246",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "GET / HTTP/1.1\\r\\nHost: www.baidu.com\\r\\n\\r\\n",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000226",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "maat_scan_object",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"object_name": "226_url_object",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000247"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000227",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "maat_scan_object",
|
||
"rule_table_name": "RULE_FIREWALL_DEFAULT",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"object_name": "227_url_object",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000248"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000228",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "NotConditionHitPath",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"negate_option": false,
|
||
"condition_index": 1,
|
||
"objects": [
|
||
{
|
||
"object_name": "228_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000249",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "youtube.com",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"attribute_name": "ATTRIBUTE_IP_CONFIG",
|
||
"negate_option": true,
|
||
"condition_index": 2,
|
||
"objects": [
|
||
{
|
||
"object_name": "228_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000250",
|
||
"items": [
|
||
{
|
||
"table_name": "IP_CONFIG",
|
||
"table_type": "ip",
|
||
"table_content": {
|
||
"ip": "192.168.101.102/32"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000229",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "StringScan.Regex",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_URL",
|
||
"objects": [
|
||
{
|
||
"object_name": "229_url_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000251",
|
||
"items": [
|
||
{
|
||
"table_name": "HTTP_URL",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "É",
|
||
"expr_type": "regex"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000230",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "ipv6_::",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "230_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000256",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "2607:5d00:2:2::32:28/128",
|
||
"port": "80-443"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000231",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "should_not_hit",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "231_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000257",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "2607:5d00:2:2::32:28/128",
|
||
"port": "80"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000232",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "should_not_hit",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "IP_PLUS_CONFIG",
|
||
"objects": [
|
||
{
|
||
"object_name": "232_IP_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000258",
|
||
"items": [
|
||
{
|
||
"table_type": "ip",
|
||
"table_name": "IP_PLUS_CONFIG",
|
||
"table_content": {
|
||
"ip": "192.168.30.44/32",
|
||
"port": "80"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000233",
|
||
"service": 1,
|
||
"action": 1,
|
||
"do_blacklist": 1,
|
||
"do_log": 1,
|
||
"action_parameter": "maat_scan_object",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "HTTP_RESPONSE_KEYWORDS",
|
||
"object_name": "233_url_object",
|
||
"object_uuids": [
|
||
"00000000-0000-0000-0000-000000000259"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000234",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "Payload escape",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"negate_option": false,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "EscapeObject_234_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000260",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "html>\\\\r\\\\n",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000235",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "Payload escape",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"negate_option": false,
|
||
"condition_index": 0,
|
||
"objects": [
|
||
{
|
||
"object_name": "EscapeObject_235_1",
|
||
"uuid": "00000000-0000-0000-0000-000000000261",
|
||
"items": [
|
||
{
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_type": "expr",
|
||
"table_content": {
|
||
"expression": "\\(\\)abc\\^\\$def\\|",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"uuid": "00000000-0000-0000-0000-000000000236",
|
||
"service": 0,
|
||
"action": 0,
|
||
"do_blacklist": 0,
|
||
"do_log": 0,
|
||
"action_parameter": "StringScan.HexBinCombineString",
|
||
"is_valid": "yes",
|
||
"and_conditions": [
|
||
{
|
||
"attribute_name": "KEYWORDS_TABLE",
|
||
"objects": [
|
||
{
|
||
"object_name": "236_keywords_object",
|
||
"uuid": "00000000-0000-0000-0000-000000000262",
|
||
"items": [
|
||
{
|
||
"table_type": "expr",
|
||
"table_name": "KEYWORDS_TABLE",
|
||
"table_content": {
|
||
"expression": "cd |6162|",
|
||
"expr_type": "and"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"plugin_table": [
|
||
{
|
||
"table_name": "QD_ENTRY_INFO",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000001", "ip":"192.168.0.1", "entry_id":101, "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000002", "ip":"192.168.0.2", "entry_id":102, "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000003", "ip":"192.168.1.1", "entry_id":103, "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_PLUGIN_EXDATA_TABLE",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000001", "key":"HeBei", "city":"Shijiazhuang", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000002", "key":"HeNan", "city":"Zhengzhou", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000003", "key":"ShanDong", "city":"Jinan", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000004", "key":"ShanXi", "city":"Taiyuan", "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_PLUGIN_LONG_KEY_TYPE_TABLE",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000001", "key":11111111, "city":"Shijiazhuang", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000002", "key":22222222, "city":"Zhengzhou", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000003", "key":33333333, "city":"Jinan", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000004", "key":44444444, "city":"Taiyuan", "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_PLUGIN_INT_KEY_TYPE_TABLE",
|
||
"table_content": [
|
||
{ "uuid":"00000000-0000-0000-0000-000000000001", "key":101, "city":"China", "is_valid":1},
|
||
{ "uuid":"00000000-0000-0000-0000-000000000002", "key":102, "city":"America", "is_valid":1},
|
||
{ "uuid":"00000000-0000-0000-0000-000000000003", "key":103, "city":"Russia", "is_valid":1},
|
||
{ "uuid":"00000000-0000-0000-0000-000000000004", "key":104, "city":"Japan", "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_PLUGIN_IP_KEY_TYPE_TABLE",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000001", "key":"100.64.1.1", "addr_type":4, "city":"XiZang", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000002", "key":"100.64.1.2", "addr_type":4, "city":"XinJiang", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000003", "key":"2001:da8:205:1::101", "addr_type":6, "city":"GuiZhou", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000004", "key":"1001:da8:205:1::101", "addr_type":6, "city":"SiChuan", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000005", "key":"100.64.1.3", "addr_type":7, "city":"QingHai", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000006", "key":"100.64.1.4", "addr_type":6, "city":"GanSu", "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_IP_PLUGIN_WITH_EXDATA",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000101", "ip":"192.168.30.99-192.168.30.101", "buffer":"Something-like-json", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000102", "ip":"192.168.30.90-192.168.30.128", "buffer":"Bigger-range-should-in-the-back", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000103", "ip":"2001:db8:1234::-2001:db8:1235::", "buffer":"Bigger-range-should-in-the-back", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000104", "ip":"2001:db8:1234::1-2001:db8:1234::5210", "buffer":"Something-like-json", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000105", "ip":"2620:100:3000::-2620:0100:30ff:ffff:ffff:ffff:ffff:ffff", "buffer":"Bugreport-liumengyan-20210517", "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_IPPORT_PLUGIN_WITH_EXDATA",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000101", "ip":"192.168.100.1", "port":"0-255", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000102", "ip":"192.168.100.2", "port":"100-200", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000103", "ip":"192.168.100.1", "port":"255-300", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000104", "ip":"2001:db8:1234::5210", "port":"255-512", "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_FQDN_PLUGIN_WITH_EXDATA",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000201", "fqdn":"www.example1.com", "buffer":"catid=1", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000202", "fqdn":"*.example1.com", "buffer":"catid=1", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000203", "fqdn":"news.example1.com", "buffer":"catid=2", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000204", "fqdn":"r3---sn-i3belne6.example2.com", "buffer":"catid=3", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000205", "fqdn":"r3---sn-i3belne6.example2.com", "buffer":"catid=3", "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_BOOL_PLUGIN_WITH_EXDATA",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000301", "bool_expr":"1&2&1000", "buffer":"tunnel1", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000302", "bool_expr":"101&102", "buffer":"tunnel2", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000303", "bool_expr":"102", "buffer":"tunnel3", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000304", "bool_expr":"101", "buffer":"tunnel4", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000305", "bool_expr":"0&1&2&3&4&5&6&7", "buffer":"tunnel5", "is_valid":1},
|
||
{"uuid":"00000000-0000-0000-0000-000000000306", "bool_expr":"101&101", "buffer":"invalid", "is_valid":1}
|
||
]
|
||
},
|
||
{
|
||
"table_name": "TEST_EFFECTIVE_RANGE_TABLE",
|
||
"table_content": [
|
||
{"uuid":"00000000-0000-0000-0000-000000000001", "status":"SUCCESS", "entry_id":99, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里"]},{"tag":"isp","value":["电信","移动"]}]]} },
|
||
{"uuid":"00000000-0000-0000-0000-000000000002", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":0},
|
||
{"uuid":"00000000-0000-0000-0000-000000000003", "status":"FAILED", "entry_id":11, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里","上海/浦东/陆家嘴"]},{"tag":"isp","value":["电信","联通"]}], [{"tag":"location","value":["北京"]},{"tag":"isp","value":["联通"]}]]} },
|
||
{"uuid":"00000000-0000-0000-0000-000000000004", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{} },
|
||
{"uuid":"00000000-0000-0000-0000-000000000005", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京"]}]]} },
|
||
{"uuid":"00000000-0000-0000-0000-000000000006", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"weather","value":["hot"]}]]} }
|
||
]
|
||
},
|
||
{
|
||
"table_name": "IR_INTERCEPT_IP",
|
||
"table_content": [
|
||
{ "uuid":"00000000-0000-0000-0000-001000000130", "is_valid":1, "effective_range":{}},
|
||
{ "uuid":"00000000-0000-0000-0000-000000000161", "is_valid":1, "effective_range":0}
|
||
]
|
||
}
|
||
]
|
||
} |