Is there a way to send lists with malicious hashes via the Citrix API for blocking by WAF

[Valentin Todorov]

Hello,

 

Is there a way to dynamically send lists with malicious hashes via the Citrix API? I want to use those hashes in WAF rules, and block requests that match them.

 

 

Valentin

[Johannes Norz]

I didn't get which way you want to use the hashes. Where do they come from?

 

Citrix offers signatures, blocking well known attacks. You may use other signatures instead of the original Snort ones (Qualis, Whitehat, ...)

 

If this is not what you have been looking for: You could do a HTTP call out to send requests to a server containing signatures.

 

Visit my blog to read about the WAF :)