trAvis - MANAGER

Edit File: modsecurity_crs_48_bayes_analysis.conf

# --------------------------------------------------------------- # Core ModSecurity Rule Set ver.2.2.9 # Copyright (C) 2006-2012 Trustwave All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under # Apache Software License (ASL) version 2 # Please see the enclosed LICENCE file for full details. # --------------------------------------------------------------- # # You must edit the local path to the lua scripts # SecRule TX:'/^\\\d.*WEB_ATTACK/' ".*" "phase:2,id:'900033',t:none,log,pass,logdata:'%{tx.bayes_msg}',exec:lua/bayes_train_spam.lua" SecRuleScript lua/bayes_check_spam.lua "phase:2,id:'900034',t:none,block,msg:'Bayesian Analysis Detects Probable Attack.',logdata:'Score: %{tx.bayes_score}',severity:'2',tag:'WEB_ATTACK/SQL_INJECTION',tag:'WASCTC/WASC-19',tag:'OWASP_TOP_10/A1',tag:'OWASP_AppSensor/CIE1',tag:'PCI/6.5.2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/BAYESIAN-%{matched_var_name}=%{tx.0}" SecRule &TX:ANOMALY_SCORE "@eq 0" "phase:5,id:'900035',t:none,log,pass,logdata:'%{tx.bayes_msg}',exec:lua/bayes_train_ham.lua"