trAvis - MANAGER

Edit File: modsecurity_crs_59_outbound_blocking.conf

# --------------------------------------------------------------- # Core ModSecurity Rule Set ver.2.2.9 # Copyright (C) 2006-2012 Trustwave All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under # Apache Software License (ASL) version 2 # Please see the enclosed LICENCE file for full details. # --------------------------------------------------------------- # You should set the score to the proper threshold you would prefer. If kept at "@gt 0" # it will work similarly to previous Mod CRS rules and will create an event in the error_log # file if there are any rules that match. If you would like to lessen the number of events # generated in the error_log file, you should increase the anomaly score threshold to # something like "@gt 20". This would only generate an event in the error_log file if # there are multiple lower severity rule matches or if any 1 higher severity item matches. # # You should also set the desired disruptive action (deny, redirect, etc...). # # Alert and Block on High Anomaly Scores - this would block outbound data leakages # SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_level}" \ "chain,phase:4,id:'981200',t:none,deny,msg:'Outbound Anomaly Score Exceeded (score %{TX.OUTBOUND_ANOMALY_SCORE}): Last Matched Message: %{tx.msg}',logdata:'Last Matched Data: %{matched_var}'" SecRule TX:ANOMALY_SCORE_BLOCKING "@streq on" chain SecRule TX:/^\d/ "(.*)"