Hi folks

I got a question today that left we thinking and no answer.

Can I, on an IPS 7.x, create a rule that compares data in a HTTP flow?

Example: User send a login request in clear text but the server responds with a different account. A custom packet sniffer app would store the data, extract the login, store it as a variable and then compare it with the response. Easy, but can the IPS do that?

Regards

Fredrik