Use this command to add one or more predefined suspicious URL rules to a suspicious URL rule group.

Each entry in a suspicious URL group defines a type of URL that the FortiWeb appliance considers to be possibly malicious when gathering data for an auto-learning profile.

HTTP requests for URLs typically associated with administrative access to your web applications or web server, for example, may be malicious if they originate from the Internet instead of your management LAN. You may want to discover such requests for the purpose of designing blacklist page rules to protect your web server.

If you know that your network’s web servers are not vulnerable to a specific type of suspicious URL, such as if the URL is associated with attacks on Microsoft IIS web servers but all of your web servers are Apache web servers, omit it from the suspicious URL group to improve performance. The FortiWeb appliance will not expend resources scanning traffic for that type of suspicious URLs.

To see the regular expressions used in the predefined suspicious URL rules, in the web UI, go to Auto Learn > Predefined Pattern > URL Pattern.

Suspicious URL groups are used by auto-learning profiles. For details, see “config server-policy policy”.

To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For more information, see “Permissions”.

This example configures a suspicious URL rule group named suspicious-url-group1 that detects HTTP requests for administratively sensitive URLs for some common web servers that could represent attack attempts and includes a custom suspicious URL rule.