The following example triggers alarms when the TLS version is detected for applications that contain SSL in their application path.
|
function Flow_DetectTlsVersion (dpiMsg, ruleEngine) -- rule content if HasApplication(dpiMsg, "ssl") then local tlsVersion = GetTlsVersion(dpiMsg); if (tlsVersion ~= nil or tlsVersion ~= '') then TriggerUserAlarm(dpiMsg, ruleEngine, "low") end end end |