URL Lists and Feeds: URL Syntax and Matching Criteria
Security Intelligence URL lists and feeds, including custom lists and feeds and entries in the global Block list and Do Not Block list, can include the following, which have the matching behavior as described:
-
Hostnames
For example,
www.example.com. -
URLs
example.commatchesexample.comand all subdomains, includingwww.example.com,eu.example.com,example.com/abc, andwww.example.com/def-- but NOTexample.co.ukorexamplexyz.comorexample.com.malicious-site.comWhen a URL feed or list includes a single entry, every URL that ends with those domains is identified and blocked.
Example: When the following URL feed —
www.netflix.com, www.amazon.*, org, edu, www.hulu.*is added to the global Block List, the following contents are blocked:http://www.amazon.in, http://www.rajiv.org/, http://www.edu.edu/, http://www.edu.org/, http://org.org/ and http://edu.edu.You can also include an entire URL path, such as
https://www.cisco.com/c/en/us/products/security/firewalls/index.html
You can create a custom URL, Network, and DNS feeds, wherein, you can add the username and password inside the URL itself, for example:
https://admin:password@server.domain.com/list.txtHowever, if your password contain special characters such as a colon (:) or an at sign (@), the transmission would fail. Ensure that your password does not have any special characters. Alternatively, you could use an encoded password in the URL.
-
A slash at the end of a URL to specify an exact match
example.com/matches ONLYexample.com; it does NOT matchwww.example.comor any other URL. -
A wildcard (*) to represent any domain in a URL
An asterisk can represent a complete domain string separated by dots, but not a partial domain string, and not any part of the URL following the first slash.
Valid examples:
-
*.example.com -
www.*.com -
example.*(This will match
example.comandexample.organdexample.de, for example, but NOTexample.co.uk) -
*.example.* -
example.*/
Invalid examples:
-
example*.com -
example.com/*
-
-
IP addresses (IPv4)
For IPv6 addresses, or to use ranges or CIDR notation, use the Security Intelligence Network object.
You can include one or more wildcards representing an octet, for example 10.10.10.* or 10.10.*.*.
See also Custom Security Intelligence Lists.