D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
opt
/
bitninja-waf
/
etc
/
crs
/
rules
/
Filename :
RESPONSE-959-BLOCKING-EVALUATION.conf
back
Copy
# ------------------------------------------------------------------------ # OWASP ModSecurity Core Rule Set ver.3.0.2 # Copyright (c) 2006-2016 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under # Apache Software License (ASL) version 2 # Please see the enclosed LICENSE file for full details. # ------------------------------------------------------------------------ # You should set the score to the proper threshold you would prefer. If kept at "@gt 0" # it will work similarly to previous Mod CRS rules and will create an event in the error_log # file if there are any rules that match. If you would like to lessen the number of events # generated in the error_log file, you should increase the anomaly score threshold to # something like "@gt 20". This would only generate an event in the error_log file if # there are multiple lower severity rule matches or if any 1 higher severity item matches. # # You should also set the desired disruptive action (deny, redirect, etc...). # # # -= Paranoia Level 0 (empty) =- (apply unconditionally) # # Alert and Block on High Anomaly Scores - this would block outbound data leakages # SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \ "phase:4,\ id:959100,\ tag:'anomaly-evaluation',\ t:none,\ deny,\ msg:'Outbound Anomaly Score Exceeded (Total Score: %{TX.OUTBOUND_ANOMALY_SCORE})'" SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:3,id:959011,nolog,pass,skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION" SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:4,id:959012,nolog,pass,skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION" # # -= Paranoia Level 1 (default) =- (apply only when tx.paranoia_level is sufficiently high: 1 or higher) # SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:3,id:959013,nolog,pass,skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION" SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:4,id:959014,nolog,pass,skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION" # # -= Paranoia Level 2 =- (apply only when tx.paranoia_level is sufficiently high: 2 or higher) # SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:3,id:959015,nolog,pass,skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION" SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:4,id:959016,nolog,pass,skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION" # # -= Paranoia Level 3 =- (apply only when tx.paranoia_level is sufficiently high: 3 or higher) # SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:3,id:959017,nolog,pass,skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION" SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:4,id:959018,nolog,pass,skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION" # # -= Paranoia Level 4 =- (apply only when tx.paranoia_level is sufficiently high: 4 or higher) # # # -= Paranoia Levels Finished =- # SecMarker "END-RESPONSE-959-BLOCKING-EVALUATION"